Privacy Policy

1.1 Who we are. iccon.world (the "Website") is owned and operated by Integratedmobi Tech Private Limited, a company incorporated in India, with its registered office at 134 M Road, Bhopalpura, Udaipur, Rajasthan 313001, India.

1.2 Our role. For the personal data described in this Policy, icconX is the "Data Fiduciary" under the Digital Personal Data Protection Act, 2023 and the rules made under it (together, the "DPDP Act"). This means we decide why and how your personal data is processed, and we are responsible for it.

1.3 Laws we follow. We process personal data in line with the DPDP Act, the Information Technology Act, 2000 (including section 43A and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent they apply), the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020.

1.4 What this Policy covers. It applies to the Website, our checkout, our customer support channels (WhatsApp, phone and email), our marketing messages and our social media pages where we collect your details directly. It does not cover websites, apps or services run by other companies, even if we link to them.

1.5 Your agreement. By using the Website or giving us your personal data, you confirm that you have read this Policy. Where we rely on your consent, we ask for it separately and clearly, and you can withdraw it at any time (section 5).

2.1 Personal data means any data about an individual who can be identified by or in relation to that data, such as a name, mobile number, email address, delivery address or order history.

2.2 Processing means any operation on personal data, such as collection, recording, storage, use, sharing, correction or erasure.

2.3 Data Principal or you means the individual to whom the personal data relates. This includes visitors to the Website, customers, people who contact our support team, and individuals who contact us about business enquiries, partnerships or jobs. For a child or a person with a disability, it includes the parent or lawful guardian acting on their behalf.

2.4 Data Processor means a company that processes personal data on our behalf and on our instructions, such as a courier or a payment partner.

2.5 Consent Manager means a person registered with the Data Protection Board of India who lets you give, manage, review and withdraw consent through one accessible platform.

2.6 Board means the Data Protection Board of India set up under the DPDP Act.

3.1 Information you give us

• Identity and contact details: name, mobile number and email address.
• Delivery and billing details: delivery address, PIN code, landmark, alternate phone number and, if you ask for a business invoice, your company name and GSTIN.
• Account details: the phone number or email you use to sign in, and your saved addresses.
• Order details: products ordered, prices, coupons used, order and invoice numbers, and cancellation, replacement or refund requests.
• Support and warranty details: messages, call details, photos, videos and invoices you send us about an order, a delivery, a fault or a warranty claim.
• Reviews and content: ratings, reviews, photos and videos you post on the Website, and the name you choose to show with them.
• Business enquiries: details you share when you ask about bulk orders, corporate gifting, partnerships or jobs.
• Contests and surveys: details you give when you take part in a contest, promotion, survey or feedback request.

3.2 Information collected automatically

• Device and connection data: IP address, approximate location (city or region, based on IP address), browser type, operating system and device type.
• Usage data: pages and products viewed, searches, items added to cart, time spent, links clicked and the website or advertisement that brought you to us.
• Cookie data: identifiers stored by cookies and similar technologies, as explained in section 7.

3.3 Information from others

• Checkout and sign-in partners: if you choose to use an address or details saved with our checkout or sign-in partner, we receive those details.
• Payment partners: payment status, payment method, transaction reference and refund status. We never receive your full card number, CVV, UPI PIN or net banking password.
• Courier partners: pickup and delivery status, delivery attempts and proof of delivery.
• Advertising and analytics partners: information about how you reached the Website from an advertisement, and aggregated reports.
• Retailers and marketplaces: if you bought an icconX product elsewhere and contact us for warranty help, the seller may share your purchase details with us at your request.

3.4 Sensitive information. We do not ask for or knowingly collect health, biometric, caste, religion, sexual orientation or similar information. Passwords and payment details are handled by our sign-in and payment partners on their secure systems. Please do not send us such information in messages or reviews.

3.5 Data about other people. If you give us someone else's personal data, for example when you send a gift or ask us to deliver to a family member, you confirm that you have their permission to share it with us for that purpose.

3.6 Giving data is your choice. You do not have to give us your personal data. If you choose not to give data that is needed for a service, such as a delivery address for an order, we may not be able to provide that service.

4.1 We process personal data only for specific, lawful purposes. The table below explains what we use and why.

Purpose	Personal data used	Basis
Take, process, pack, ship and deliver your order, and issue a GST invoice	Contact, delivery, billing and order details	Your voluntary request to buy (legitimate use under the DPDP Act)
Send order, payment, shipping, delivery and support updates	Contact and order details	Your voluntary request to buy
Handle cancellations, replacements, refunds and warranty claims	Contact, order, support and payment status details	Your voluntary request; legal duties under consumer law
Prevent fraud, misuse of offers, fake orders and payment risk	Contact, order, device and payment status details	Legitimate use for the safety of our services, as allowed by law
Answer questions and resolve complaints	Contact, order and support details	Your voluntary request
Create and manage your account	Account and contact details	Your consent
Show your reviews on the Website	Review content and display name	Your consent
Understand how the Website is used and improve it	Device, usage and cookie data	Your consent for analytics cookies
Send offers, launches and news	Contact details and marketing preferences	Your consent
Measure and show relevant ads on other platforms	Device, usage and cookie data	Your consent for advertising cookies
Run contests, promotions, surveys and feedback requests	Contact details and your responses	Your consent
Consider job applications and business enquiries	Contact details, CV and the information you share	Your voluntary request
Keep tax, accounting and legal records and respond to lawful requests	Order, invoice and payment records	Compliance with law

4.2 We do not use your personal data for purposes that are unrelated to those above without telling you and, where required, asking for your consent.

4.3 We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you.

5.1 How we ask. Where we rely on consent, we ask for it with a clear notice that lists the personal data and the purpose, for example a sign-up checkbox for marketing messages or a cookie choice. Consent is free, specific, informed, unconditional and unambiguous, and given by a clear action from you.

5.2 Withdrawing consent. You can withdraw consent at any time, as easily as you gave it: by using the unsubscribe link in our emails, by changing your cookie choices, by asking us on WhatsApp or by writing to our Grievance Officer (section 24). After you withdraw consent, we stop the related processing within a reasonable time and ask our Data Processors to do the same.

5.3 Effect of withdrawal. Withdrawal does not affect processing done before it. If you withdraw consent needed for a service, such as your account, we may not be able to provide that service. Order records that we must keep by law are not affected.

5.4 Uses that do not need consent. As allowed by section 7 of the DPDP Act, we may process personal data without separate consent where you have voluntarily given it for a specific purpose, such as completing your order, or where it is needed to comply with law, a court order or a request from a government authority, or to respond to a medical emergency or threat to safety.

5.5 Consent Managers. Once Consent Managers are operational under the DPDP Act, you may also give, review or withdraw your consent to us through a registered Consent Manager.

6.1 We do not sell your personal data. We share personal data only when needed for the purposes in section 4, and only as much as is needed. We do not share it with other companies for their own marketing.

6.2 Data Processors. We use trusted service providers who process personal data on our behalf, under contracts that require them to keep it secure and use it only on our instructions:

• E-commerce platform and hosting: to run the Website, store orders and send order emails.
• Checkout, sign-in and payments: checkout and one-tap sign-in providers, payment gateways, banks and UPI apps, to take payment and process refunds.
• Logistics: courier, shipping and warehouse partners, to pick up, pack and deliver orders and replacements.
• Customer communication: SMS, WhatsApp, email and calling service providers, to send updates and reply to you.
• Reviews: our reviews provider, to collect, verify and display product reviews.
• Analytics and advertising: analytics and advertising platforms such as Google and Meta, to measure visits and ads, where you have agreed to the related cookies.
• Professional services: auditors, chartered accountants, lawyers and consultants, who are bound by confidentiality.

6.3 Legal and safety reasons. We may share personal data with courts, regulators, tax authorities, law enforcement or other government bodies when the law requires it, or to protect the rights, property or safety of icconX, our customers or others (section 20).

6.4 Business changes. If icconX is involved in a merger, acquisition, restructuring or sale of assets, personal data may be transferred as part of that transaction. The new owner must continue to protect it in line with this Policy and the law.

6.5 Aggregated information. We may share reports that do not identify any individual, such as total sales by city.

7.1 Cookies are small text files stored on your device when you visit a website. Similar technologies include pixels, tags and local storage.

7.2 We use the following types:

Type	What it does	Can you turn it off?
Essential	Keeps the Website working, remembers your cart, keeps you signed in and secures checkout	No, the Website will not work properly without them
Analytics	Tells us which pages are visited and how the Website performs, so we can improve it	Yes
Advertising	Measures our advertisements and helps show relevant icconX offers on other platforms	Yes

7.3 You can block or delete cookies in your browser settings. Where we offer a cookie choice on the Website, you can change it at any time. Blocking essential cookies may stop the cart, sign-in or checkout from working.

7.4 Some cookies last only until you close your browser (session cookies). Others stay on your device for a set period to remember your preferences, including your cookie choices (persistent cookies).

8.1 Service messages. Order confirmations, payment, shipping and delivery updates, replacement and refund updates, and replies to your requests are part of our service. They are sent by SMS, WhatsApp, email or call to the details you give us. You cannot opt out of these messages while you have an open order, replacement or support request.

8.2 Marketing messages. Offers, launches and news are sent only if you have agreed to receive them. You can unsubscribe at any time using the unsubscribe link in an email, or by asking us on WhatsApp or at support@iccon.world. We follow the rules of the Telecom Regulatory Authority of India on commercial communications.

8.3 Stay safe from fraud. icconX will never ask for your OTP, card number, CVV, UPI PIN or passwords by call, SMS, WhatsApp or email, and will never ask you to pay to a personal account. If you receive such a request in our name, do not respond and report it to us.

9.1 Your personal data is stored on secure servers operated by us or by our Data Processors. Some of these servers may be located outside India.

9.2 We transfer personal data outside India only as permitted by the DPDP Act, and not to any country or territory restricted by the Government of India. We require our Data Processors to protect transferred data with appropriate safeguards.

10.1 We keep personal data only for as long as it is needed for the purpose for which it was collected, or as required by law.

Personal data	How long we keep it
Orders, invoices and payment records	At least 6 years under GST law and up to 8 years under the Companies Act, 2013
Support, replacement and warranty records	Until the end of the product's warranty period and one year after it
Account details	While your account is active, or until you ask us to delete it
Marketing preferences	Until you unsubscribe or withdraw consent; we keep a record of the opt-out so we do not contact you again
Analytics and cookie data	Up to 26 months, or as set by your cookie choices
Reviews	While they are published, or until you ask us to remove them
Records of consent, requests and grievances	For as long as needed to show that we met our legal duties

10.2 When personal data is no longer needed, we delete it or make it anonymous so that it can no longer identify you, unless we must keep it for a legal reason such as a pending dispute.

11.1 You can ask us to delete your account and personal data by writing to our Grievance Officer at support@iccon.world or on WhatsApp at +91 90018 86580, from the email or mobile number linked to your orders.

11.2 We will verify your identity, confirm your request and complete the deletion within 30 days, unless the law requires us to keep some records.

11.3 Records we must keep by law, such as invoices, will be kept for the required period and then deleted. Reviews you posted may be removed or shown without your name.

11.4 After deletion, you will not be able to see your past orders on the Website, and open orders, replacements or warranty claims may need to be completed first.

12.1 Under the DPDP Act, you have the right to:

• Access: get a summary of the personal data we process about you, the processing we carry out, and the identities of the Data Fiduciaries and Data Processors we have shared it with, together with a description of the data shared;
• Correction and erasure: have inaccurate or misleading data corrected, incomplete data completed, data updated, and data erased when it is no longer needed, unless we must keep it by law;
• Withdraw consent: at any time, for processing based on consent (section 5);
• Grievance redressal: have your complaint about our handling of your personal data addressed by our Grievance Officer (section 24);
• Nominate: nominate another person to exercise your rights if you die or become unable to do so because of unsoundness of mind or infirmity of body;
• Complain to the Board: approach the Data Protection Board of India if you are not satisfied with our response to your grievance.

12.2 How to use your rights. Write to our Grievance Officer with your name, the email or mobile number used with us and the right you wish to use. We may ask for reasonable proof of identity so that we do not disclose or change data for the wrong person.

12.3 Response time. We acknowledge requests within 48 hours and aim to respond within one month, and in any case within the time set by law. There is no charge for making a request.

12.4 Limits. In some cases the law allows or requires us to refuse or limit a request, for example where data must be kept for tax records or for a legal claim. If so, we will tell you why.

13.1 Under section 15 of the DPDP Act, when you use your rights you must:

• follow applicable laws;
• not impersonate another person while giving personal data;
• not hide material information when giving personal data for an official document or proof of identity;
• not register a false or frivolous grievance or complaint with us or the Board;
• give only verifiably authentic information when you ask us to correct or erase your data.

13.2 Breach of these duties may attract a penalty under the DPDP Act.

14.1 The Website is meant for adults. A child, under the DPDP Act, is a person below 18 years of age.

14.2 We do not knowingly collect personal data of a child without verifiable consent of the parent or lawful guardian. We do not track or monitor the behaviour of children, and we do not show them targeted advertising.

14.3 Before processing a child's personal data, we will verify that the person giving consent is an adult parent or lawful guardian, using identity and age details we already hold, or a government-issued identity document or virtual token such as through DigiLocker, as allowed by law.

14.4 If you are a parent or guardian and believe that your child has shared personal data with us without your consent, please contact our Grievance Officer and we will delete it.

15.1 Where a person with a disability has a lawful guardian, we will process their personal data with the verifiable consent of that guardian, as required by the DPDP Act.

15.2 We may ask for reasonable proof that the guardian has been appointed under applicable law before acting on their instructions.

16.1 We follow reasonable security practices and procedures, as required by section 43A of the Information Technology Act, 2000 and the DPDP Act, appropriate to the nature of the data we hold. These include:

• encrypted connections (HTTPS) across the Website;
• payment pages hosted by certified payment partners, so that we never handle card or UPI credentials;
• access to personal data only for staff and partners who need it for their work;
• confidentiality obligations for our staff and contracts with our Data Processors;
• keeping logs of access to personal data, retained for at least one year as required by law, and reviewing our safeguards from time to time;
• backups maintained by our platform providers, so that data can be restored if a system fails.

16.2 No method of transmission over the internet or of electronic storage is completely secure. Please keep your sign-in details and OTPs private and contact us if you notice anything unusual on your account.

17.1 If a personal data breach occurs, we will act quickly to contain it, find out what happened and reduce any harm.

17.2 We will inform the Data Protection Board of India and each affected Data Principal without undue delay, as required by the DPDP Act. Our notice will describe the breach, its likely impact, the steps we are taking and what you can do to protect yourself, and give a contact for questions.

18.1 The Website may contain links to other websites and to social media platforms such as Instagram, Facebook, YouTube and WhatsApp. Payments and some sign-in steps take place on pages run by our partners.

18.2 These services have their own privacy policies, and we are not responsible for how they process personal data. Please read their policies before giving them your information.

19.1 Reviews, ratings, photos and videos you post on the Website are public. Please do not include personal data such as phone numbers, addresses or order numbers in them.

19.2 We may show your reviews with the display name you choose. You can ask us to remove a review or your name from it at any time.

20.1 We may disclose personal data to government agencies, regulators, courts or law enforcement when required by law, a court order or a lawful request, or when needed to prevent, detect or investigate fraud, cyber security incidents or offences.

20.2 We check that such requests are lawful and disclose only what is required.

21.1 We may update this Policy from time to time to reflect changes in the law, our services or our partners. The current version is always on this page.

21.2 If a change materially affects how we use your personal data, we will inform you by email, by a notice on the Website or by another suitable method, and ask for fresh consent where the law requires it.

22.1 This Policy is governed by the laws of India.

22.2 Please contact our Grievance Officer first so that we can try to resolve any concern quickly. You may also approach the Data Protection Board of India in accordance with the DPDP Act. Subject to this, the courts at Udaipur, Rajasthan have jurisdiction over disputes relating to this Policy.

23.1 We take reasonable care to protect your personal data, but we are not responsible for loss or misuse caused by events outside our reasonable control, by your sharing of sign-in details or OTPs, or by the independent actions of third-party websites and services. Nothing in this Policy limits your rights under the DPDP Act or any other law that cannot be excluded.

24.1 For any question, request or complaint about your personal data or this Policy, please contact our Grievance Officer, who is also the person designated to answer questions about how we process personal data:

Mohit Sahu, Grievance Officer
Integratedmobi Tech Private Limited
134 M Road, Bhopalpura, Udaipur, Rajasthan 313001, India
Phone: +91 90018 86580 (Monday to Saturday, 10 AM to 6 PM)
Email: support@iccon.world

24.2 We will acknowledge your complaint within 48 hours and resolve it within one month of receipt. If you are not satisfied with our response, you may approach the Data Protection Board of India.