Privacy policy

OOZUBA

A brand of Zarna Enterprise

DPDP Act, 2023 and GDPR-aligned notice and consent framework for www.oozuba.com

Effective Date: 7th July 2026

1. INTRODUCTION AND SCOPE

1.1 This Privacy Policy ("Policy") explains how Zarna Enterprise, operating under the brand "Oozuba" ("we", "us", "our"), collects, uses, discloses, retains, and protects personal data relating to visitors of www.oozuba.com ("Website") and individuals who submit an enquiry, place an Order, or otherwise interact with us via the Website, WhatsApp, email, or any other channel ("you").

1.2 This Policy is drafted to align with (a) India's Digital Personal Data Protection Act, 2023 and its rules ("DPDP Act"), as Zarna Enterprise is established in India and is the "Data Fiduciary" under that Act; and (b) the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR/Data Protection Act 2018 (together, "GDPR"), to the extent we process personal data of individuals located in the EU/UK — for example, contact persons at a buyer company — in connection with offering goods to them, in which case we act as "Controller" under GDPR.

1.3 Where this Policy uses a term specific to one framework (e.g., "Data Principal" under the DPDP Act, or "Data Subject" under GDPR), it should be read as referring to you, regardless of which framework applies to your case. Where the two frameworks impose different standards, we apply whichever is more protective of you, unless a provision below expressly states that a right or mechanism applies only under one framework.

1.4 This Policy is incorporated into, and forms part of, the Terms and Conditions, and is designed to serve as the notice and consent mechanism referenced on the Website's enquiry, order, and transaction forms — see Clause 5 and Annexure A.

2. KEY TERMS

2.1 "Personal Data": any information relating to an identified or identifiable individual, under both the DPDP Act and GDPR.

2.2 "Processing": any operation performed on personal data, including collection, storage, use, sharing, and erasure.

2.3 "Data Fiduciary" (DPDP Act) / "Controller" (GDPR): Zarna Enterprise (operating as Oozuba), which determines the purpose and means of processing your personal data.

2.4 "Data Principal" (DPDP Act) / "Data Subject" (GDPR): the individual to whom the personal data relates — i.e., you.

2.5 "Consent Manager" and "Data Protection Board" have the meanings given under the DPDP Act. "Supervisory Authority" means the data protection regulator with jurisdiction over you under GDPR (e.g., your EU member state's authority, or the UK Information Commissioner's Office ("ICO") for UK residents).

3. DATA FIDUCIARY / CONTROLLER DETAILS

Zarna Enterprise, operating under the brand Oozuba, having its registered/principal place of business at [Insert Registered Business Address], India, is the Data Fiduciary/Controller responsible for your personal data under this Policy. We have not appointed a Data Protection Officer, as our processing does not currently meet the thresholds requiring one under either framework; this will be reviewed if our processing activities expand. For any query, use the contact details at Clause 13.

Drafting note: If Oozuba regularly offers goods to, or monitors the behaviour of, individuals in the EU/UK, Article 27 GDPR requires appointment of a local representative in the EU and/or UK (unless an exemption applies, e.g., only occasional, low-risk processing). Assess buyer volume from the EU/UK and appoint a representative if the threshold is met — flag to counsel.

4. PERSONAL DATA WE COLLECT

4.1 Information you provide directly, typically via an enquiry form, order form, WhatsApp message, or email: name, company name, designation, email address, phone/WhatsApp number, country, shipping/billing address, order specifications, design files/artwork, and payment/bank reference details for verifying wire transfers (we do not collect or store full card or bank credentials).

4.2 Information collected automatically when you browse the Website: IP address, browser/device type, approximate location (derived from IP or your country selection), pages visited, referring website, and similar usage data, collected via cookies and similar technologies (see Clause 9).

4.3 Information from third parties: information received from payment processors, freight forwarders/carriers, customs brokers, or business partners in connection with fulfilling your Order.

4.4 We do not intentionally collect any special category of personal data (e.g., health, biometric, racial/ethnic origin, or financial account credentials) through the Website. Please do not include such information in enquiry or order forms unless specifically requested by us for a stated, lawful purpose.

5. HOW WE COLLECT CONSENT

5.1 Where we rely on your consent (the primary basis for most processing under this Policy, and the mandatory basis for any marketing communication or non-essential cookie), we give you, before or at the time consent is sought, a notice in clear and plain language itemizing: (a) the personal data to be collected; (b) the specific purpose of processing; and (c) how to exercise your rights and lodge a grievance/complaint. A representative form of this notice is at Annexure A.

5.2 Consent collected through our forms is: free, specific, informed, unconditional, unambiguous, and given through a clear affirmative action (e.g., ticking an unchecked box) — satisfying both the DPDP Act's consent standard and GDPR's requirement that consent be freely given, specific, informed, and an unambiguous indication by a clear affirmative act (Articles 4(11) and 7 GDPR). We do not use pre-ticked boxes or bundle consent for unrelated purposes.

5.3 Where a form requests both (i) personal data necessary to respond to your enquiry/Order, and (ii) optional personal data or optional processing (e.g., marketing communications), these are presented as separate, unbundled consent options, and you may decline the optional element without affecting the primary enquiry/Order.

5.4 Where you initiate contact with us directly via WhatsApp or email without completing a form, your provision of personal data in that message, together with our provision of an equivalent notice at the earliest opportunity, constitutes your consent (or, for EU/UK individuals, is processed on the legal basis described in Clause 6) for us to process that data for the purpose of responding to and fulfilling that specific enquiry/Order.

5.5 Withdrawal of Consent. You may withdraw consent at any time, with the withdrawal taking effect prospectively and being at least as easy to exercise as it was to give (required under both the DPDP Act and Article 7(3) GDPR), by using the contact details at Clause 13. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and we may continue to retain and process data to the extent required to comply with law (see Clause 10) or to complete a transaction already in progress. Withdrawing consent necessary to process an active Order may result in our inability to continue fulfilling that Order, with any consequence under the Commercial Terms and Conditions (e.g., regarding cancellation) applying accordingly.

6. LAWFUL BASIS FOR PROCESSING

6.1 DPDP Act basis. We process your personal data on the basis of your consent (Clause 5), or, in limited circumstances recognized under the DPDP Act, on the basis that you have voluntarily provided personal data to us for a specified purpose and have not indicated non-consent to its use for that purpose (e.g., responding to an enquiry you initiated).

6.2 GDPR basis. Where GDPR applies to you, we rely on one or more of the following lawful bases under Article 6(1) GDPR, as applicable to the specific processing activity:

(a) Consent — for marketing communications and non-essential cookies (Article 6(1)(a));

(b) Performance of a contract, or steps at your request prior to entering one — for processing your enquiry and fulfilling an Order (Article 6(1)(b));

(c) Legal obligation — for compliance with tax, customs, export-control, and accounting record-keeping requirements (Article 6(1)(c)); and

(d) Legitimate interests — for basic Website security and fraud prevention, where our interest is not overridden by your interests or fundamental rights (Article 6(1)(f)).

6.3 Even where we rely on a legal basis other than consent under GDPR, we still provide the itemized notice described in Clause 5.1 and honour the rights in Clause 11.

7. PURPOSE OF PROCESSING

We process your personal data only for the specific, itemized purpose(s) disclosed to you at the point of collection, which will generally include one or more of the following:

(a) responding to your enquiry and preparing a quotation;

(b) processing, confirming, and fulfilling your Order, including preparing invoices and shipping/export documentation;

(d) verifying payment and preventing fraud;

(e) complying with legal, tax, customs, and export-control obligations;

(f) improving the Website and our product offering (using aggregated/de-identified data where feasible); and

(g) sending marketing/newsletter communications, only where you have separately and affirmatively opted in, and which you may opt out of at any time.

We do not use your personal data for any automated decision-making or profiling that produces legal or similarly significant effects on you.

8. DISCLOSURE AND SHARING OF PERSONAL DATA

8.1 We do not sell your personal data. We may share personal data, strictly on a need-to-know basis and under confidentiality/data-processing obligations, with:

(a) our logistics/freight partners, customs brokers, and carriers, to the extent necessary to fulfil an Order;

(b) our bankers/payment verification providers, to process and verify payment;

(d) governmental, regulatory, customs, or law-enforcement authorities, where required by applicable law;

(e) a Consent Manager registered with the Data Protection Board of India, if and when you choose to manage consent through such a platform; and

(f) any successor entity, in connection with a genuine business transfer, subject to that entity being bound by materially equivalent privacy commitments.

8.2 Any third party processing personal data on our behalf does so under a written agreement requiring it to process personal data only on our instructions and to apply appropriate security measures, consistent with Article 28 GDPR where applicable.

9. COOKIES AND SIMILAR TECHNOLOGIES

The Website may use cookies and similar technologies to remember your preferences (e.g., country/currency/language selection) and to analyze traffic. Cookies strictly necessary for essential Website functionality do not require separate consent. Any non-essential/analytics or marketing cookie is only set with your prior consent, obtained via a cookie banner or equivalent mechanism, in line with the ePrivacy requirements applicable to EU/UK visitors and DPDP Act consent principles for all visitors. You may withdraw cookie consent or manage cookies at any time through the cookie banner (where shown) or your browser settings; disabling cookies may affect certain Website functionality.

10. DATA RETENTION AND ERASURE

10.1 We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required to comply with legal, accounting, tax, customs, and export-documentation retention requirements, whichever is longer — consistent with the storage-limitation principle under Article 5(1)(e) GDPR and the erasure obligations under the DPDP Act.

10.2 Where you withdraw consent, or where the specified purpose is no longer being served and retention is not otherwise required by law, we will erase your personal data within a reasonable period.

10.3 On erasure of your data, we will also direct any data processor engaged by us to erase corresponding personal data, save where separately required to retain it by law.

11. YOUR RIGHTS

11.1 Rights available to all Data Principals/Data Subjects, regardless of location:

(a) Access — obtain confirmation of, and a copy of, the personal data we hold about you and the processing activities undertaken;

(b) Correction/Rectification — request correction of inaccurate or incomplete personal data;

(c) Erasure — request erasure of personal data that is no longer necessary for the purpose for which it was collected, subject to Clause 10;

(d) Withdraw Consent — as described in Clause 5.5;

(e) Grievance Redressal / Complaint — raise a grievance regarding our processing of your personal data, addressed as set out in Clause 12; and

(f) Nominate (DPDP Act) — nominate another individual to exercise your rights in the event of your death or incapacity.

11.2 Additional rights for individuals located in the EU/UK, under GDPR:

(g) Restriction of Processing — request that we restrict processing of your personal data in certain circumstances (Article 18);

(h) Data Portability — receive personal data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller, where processing is based on consent or contract and carried out by automated means (Article 20);

(i) Object — object to processing based on legitimate interests, or to processing for direct marketing at any time (Article 21); and

(j) Lodge a Complaint — lodge a complaint with your local Supervisory Authority (e.g., your EU member state's data protection authority, or the UK ICO), without prejudice to any other administrative or judicial remedy.

11.3 We will respond to a verified request within a reasonable time, and in any event within any statutory timeline applicable to the request (including the one-month response period under GDPR, extendable by two further months for complex requests, and the timeline prescribed under the DPDP Act, as applicable).

12. GRIEVANCE OFFICER AND ESCALATION

12.1 If you have a grievance regarding the processing of your personal data, please contact our Grievance Officer at: [Insert Grievance Officer Name/Designation] | [Insert Email] | [Insert Registered Business Address].

12.2 We will acknowledge and address your grievance within a reasonable period, and in any event within the timeline prescribed under the DPDP Act.

12.3 If you are not satisfied with our response: (a) Data Principals may escalate the matter to the Data Protection Board of India (once operational); and (b) EU/UK Data Subjects may lodge a complaint with their local Supervisory Authority (e.g., the UK ICO at ico.org.uk, or their EU member state's data protection authority), in addition to or instead of contacting us.

13. CONTACT

For any query, request, or consent-related matter under this Policy, please contact us at: zarnainsiderportal@gmail.com | +91 9082815502 | 5/1 , Rajda Chawl, 2nd Cross Hanuman Lane , Ground Floor , Kalbadevi Road , Mumbai - 400002 Godown: 109-A, Old Hanuman Lane, 3rd floor, Room no. 13/14, Kalbadevi Road, Mumbai 400002, India.

14. DATA SECURITY AND BREACH NOTIFICATION

14.1 We implement reasonable technical and organizational security safeguards appropriate to the nature of the personal data we hold, to prevent unauthorized access, alteration, disclosure, or destruction.

14.2 In the event of a personal data breach, we will: (a) notify the Data Protection Board of India and affected Data Principals in the manner and within the timeframe prescribed under the DPDP Act; and (b) where the breach concerns personal data of EU/UK individuals and is likely to result in a risk to their rights and freedoms, notify the competent Supervisory Authority without undue delay and, where feasible, within 72 hours of becoming aware of it, and communicate the breach to affected individuals without undue delay where it is likely to result in a high risk to them, consistent with Articles 33–34 GDPR.

14.3 No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

15. INTERNATIONAL TRANSFER OF PERSONAL DATA

15.1 We are established in India and serve Buyers internationally, including across African markets, the UAE, and, where applicable, the EU/UK. Personal data may therefore be transferred to, stored, and processed in India and in other countries where we or our service providers (e.g., logistics, IT infrastructure) operate.

15.2 DPDP Act basis. Cross-border transfer of personal data from India is permitted under the DPDP Act except to countries or territories restricted by the Central Government of India by notification.

15.3 GDPR basis. Where personal data of an individual in the EU/UK is transferred to India or another country outside the EU/UK, we will ensure the transfer is protected by an appropriate safeguard recognized under Chapter V GDPR — such as an adequacy decision (where available), the European Commission's Standard Contractual Clauses (or the UK's International Data Transfer Agreement/Addendum), or another lawful transfer mechanism — before the transfer takes place.

15.4 If you are located outside India and your local law grants you a data-protection right not otherwise reflected in this Policy, please contact us at Clause 13 and we will consider it in good faith. Given Oozuba's buyer base spans multiple countries, we recommend flagging any jurisdiction-specific requirement to us directly so it can be addressed for your relationship.

16. CHILDREN'S DATA

The Website and our services are intended for business/commercial use by adults and are not directed at children. We do not knowingly collect personal data from, or process personal data in a manner likely to cause harm to, a child (under 18 under the DPDP Act; under 16, or the lower age permitted by local law, under GDPR), and do not carry out tracking, behavioural monitoring, or targeted advertising directed at children. If we become aware that we have inadvertently collected a child's personal data without verifiable parental/guardian consent, we will erase it promptly.

17. THIRD-PARTY LINKS

The Website may contain links to third-party platforms (e.g., Instagram, WhatsApp). We are not responsible for the privacy practices of such third parties, and we encourage you to review their respective privacy policies.

18. UPDATES TO THIS POLICY

We may update this Policy from time to time by posting the revised version on the Website. Where a change materially affects how we process your personal data for a purpose you previously consented to, we will seek fresh consent before relying on it. Material changes will be indicated by updating the "Last Updated" date below.

Last Updated: [Insert Date]

19. GOVERNING LAW

This Policy is governed by the laws of India, including the DPDP Act. This Clause 19 does not override any right you may have under GDPR or another local law that cannot lawfully be excluded, including your right to lodge a complaint with your local Supervisory Authority under Clause 11.2(j).

20. INCORPORATION

This Policy is incorporated by reference into, and forms part of, the Terms and Conditions.

ANNEXURE A — CONSENT NOTICE FOR WEBSITE FORMS

Primary consent (mandatory — required to process the enquiry/Order)

"I have read and understood the Oozuba Privacy Policy [hyperlink]. I consent to Zarna Enterprise (operating as Oozuba) collecting and processing the personal data I provide in this form — including my name, contact details, and order/enquiry details — for the purpose of responding to my enquiry and/or processing my Order, including sharing it with logistics, customs, and payment partners strictly as necessary for that purpose, in accordance with the Privacy Policy. I understand I may withdraw this consent at any time by contacting Oozuba, and that withdrawal may affect an Order already in progress."

Marketing consent (optional — separate checkbox)

"I would also like to receive occasional marketing and newsletter communications from Oozuba about new collections and offers. I understand I can opt out at any time."

WhatsApp-initiated enquiries (where no form is used)

"By messaging us on WhatsApp, you agree that we may process the information you share for the purpose of responding to your enquiry, in accordance with our Privacy Policy [link]. You may withdraw this consent at any time by informing us."

EU/UK visitors — cookie banner (non-essential cookies)

"We use cookies. Essential cookies are always on. With your consent, we'd also like to use analytics/marketing cookies to understand Website traffic and improve your experience. You can accept, reject, or manage preferences below, and change your choice at any time." [Accept] [Reject] [Manage Preferences]

OOZUBA

A brand of Zarna Enterprise

Custom Design Protection Policy

Buyer-supplied designs, IP clearance and waiver, design ownership, and right to refuse

Effective Date: 7th July 2026

1. SCOPE AND PURPOSE

1.1 This Custom Design Protection Policy ("Design Policy") governs designs, artwork, patterns, logos, trademarks, and specifications supplied by a Buyer to Zarna Enterprise/Oozuba ("Seller") for the purpose of custom/bespoke manufacture ("Buyer-Supplied Materials"), and any design developed by the Seller in connection with an Order ("Seller-Developed Materials").

1.2 This Design Policy is incorporated into, and forms part of, the Terms and Conditions.

2. CUSTOMER-SUPPLIED DESIGNS AND SPECIFICATIONS

2.1 Where a Buyer supplies Buyer-Supplied Materials for use in custom manufacture — including prints, motifs, embroidery patterns, colourways, sizing charts, brand labels, or packaging designs — the Buyer shall ensure such materials are supplied in a format and quality reasonably usable by the Seller for production.

2.2 The Seller shall use Buyer-Supplied Materials solely for the purpose of fulfilling the relevant Order, unless otherwise agreed in writing.

3. BUYER REPRESENTATIONS, WARRANTIES AND WAIVER

3.1 The Buyer represents and warrants that:

(a) it owns, or holds all necessary licences, permissions, and clearances for, all Buyer-Supplied Materials;

(b) the use, reproduction, and manufacture of the Buyer-Supplied Materials as instructed by the Buyer does not infringe any copyright, trademark, design right, patent, or other intellectual property or proprietary right of any third party; and

(c) it has obtained all necessary consents (including from any brand owner, licensor, or rights holder) for the Seller to manufacture goods bearing the Buyer-Supplied Materials.

3.2 The Buyer irrevocably waives any claim against the Seller, and releases the Seller from any liability,arising from the Seller's good-faith reliance on the representations in Clause 3.1, and shall fully indemnify the Seller in accordance with Clause 7 of the Terms and Conditions in respect of any third-party claim (including of intellectual property infringement, counterfeiting, or passing off) arising from the manufacture, sale, import, or export of goods incorporating Buyer-Supplied Materials.

3.3 The Seller undertakes no independent obligation to verify or clear the intellectual property status of Buyer-Supplied Materials, and its acceptance of an Order incorporating such materials shall not be construed as any representation regarding their legality or non-infringing status.

4. RIGHT TO REFUSE DESIGNS

4.1 The Seller reserves the absolute right, in its sole discretion and without liability, to refuse to accept, produce, or continue producing any Order incorporating Buyer-Supplied Materials (or any design generally) where the Seller reasonably suspects that such materials:

(a) infringe the intellectual property, trademark, or other proprietary rights of a third party;

(b) are unlawful, counterfeit, obscene, defamatory, or otherwise objectionable;

(d) are, in the Seller's reasonable technical assessment, unsuitable for production on the specified fabric/technique.

4.2 Where the Seller declines an Order, or halts production, under Clause 4.1, the Seller shall promptly notify the Buyer and shall refund any advance payment received in respect of the undelivered portion of the Order, less any costs already reasonably and demonstrably incurred by the Seller up to the date of refusal/halt.

5. OWNERSHIP OF DESIGNS

5.1 Buyer-Supplied Materials. As between the parties, ownership of original Buyer-Supplied Materials remains with the Buyer (or its licensor, as applicable). The Seller claims no ownership interest in original Buyer-Supplied Materials.

5.2 Seller-Developed Materials. Any technical production files, pattern grading, colour-separation files, repeat/layout adaptations, croquis, or other derivative production materials created by the Seller in the course of adapting Buyer-Supplied Materials for manufacture, and any design, print, pattern, or sample independently developed by the Seller (whether at the Buyer's request or otherwise) without substantial reliance on the Buyer's original artwork, shall remain the sole property of the Seller, unless expressly assigned to the Buyer in a separate signed written agreement and upon payment of any applicable design/development fee.

5.3 Non-Exclusivity. Unless the parties expressly agree to exclusivity in writing (and, where applicable, upon payment of an exclusivity premium), the Seller reserves the right to use general techniques, base fabrics, and non-Buyer-specific design elements developed in the course of an Order for other clients, and nothing in this Design Policy grants the Buyer exclusivity over any fabric base, technique, or Seller-Developed Material.

6. CONFIDENTIALITY AND SAMPLE RETENTION

6.1 The Seller shall treat Buyer-Supplied Materials that are clearly marked, or reasonably understood to be, confidential/proprietary with reasonable confidentiality, and shall not disclose such materials to unrelated third parties, save as necessary for production (e.g., sub-contracted printing/weaving units) or as required by law.

6.2 The Seller may retain a reference sample and/or digital record of goods produced (including those incorporating Buyer-Supplied Materials) for quality assurance, production records, and dispute-resolution/documentation purposes. Such retention shall not be construed as a waiver of the Buyer's rights under Clause 5.1, nor as authorization for commercial use of the Buyer-Supplied Materials by the Seller.

7. LIABILITY DISCLAIMER

7.1 The Seller shall not be liable for any claim, loss, or damage arising from Buyer-Supplied Materials, including any inaccuracy, poor quality, or unsuitability of such materials for the intended production technique, or from the Buyer's own infringement of third-party rights.

7.2 This Design Policy is subject to, and shall be read together with, the indemnity and limitation of liability provisions in Clauses 7 and 8 of the Terms and Conditions.

8. INCORPORATION

This Design Policy is incorporated by reference into, and forms part of, the Terms and Conditions.