1. Introduction & Scope

Unboxd (“Unboxd”, “we”, “us”, or “our”) operates a bespoke corporate gifting studio headquartered at Sector 40, Mohyal Colony, Gurugram, Haryana, India. We specialize in conceptualizing, crafting, and fulfilling curated corporate hampers, festive editions, and bespoke VIP keepsakes across India.

This Privacy Policy describes our governance and protection of Digital Personal Data in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, the Information Technology Act, 2000, and applicable statutory guidelines. It applies to corporate representatives using our website (unboxd.store), submitting quotation requests, and providing recipient information for multi-city bulk gifting fulfillment.

2. Categories of Personal Data We Process

Depending on how you interact with our studio, we process the following digital personal data:

• Corporate Client & Buyer Information: Contact person name, corporate designation, organization name, registered business address, GSTIN, business email address, and telephone number provided during quote requests or order commissioning.
• Recipient Delivery Data (Third-Party Principals): For multi-city fulfillment, corporate clients provide delivery manifests containing recipient employee, partner, or client names, physical delivery addresses (residential or corporate), and recipient mobile phone numbers required strictly for dispatch coordination, courier OTP generation, and delivery verification.
• Brief & Communication Data: Custom hamper specifications submitted through our custom builder, occasion details, correspondence records, and sample review feedback.
• Technical Session Data: Non-tracking, ephemeral session storage used solely to preserve brief selections when transferring from the hamper builder to the contact form. We do not engage in cross-site behavioral tracking or sell user data.

3. Lawful Grounds & Specific Purposes of Processing

Under Section 4 and Section 5 of the DPDP Act, personal data is processed solely for specified, lawful, and explicit purposes for which consent has been given or where processing is legitimate:

• Order Fulfillment & Logistics: Preparing custom hampers, printing approved branding, and routing consignments through accredited logistics carriers (e.g. Blue Dart, Delhivery, DTDC).
• Quotation & Invoicing: Generating commercial proposals, proforma invoices, formal GST tax invoices, and accounting compliance under Indian taxation statutes.
• Delivery Coordination & Status Communication: Facilitating automated delivery notifications, dispatch alerts, and proof-of-delivery (POD) confirmations.
• No Commercial Monetization: We never sell, rent, license, trade, or monetize client or recipient personal data to any third-party marketing networks or data brokers under any circumstances.

4. Corporate Client's Responsibility for Recipient Manifests

When a corporate client provides Unboxd with an address manifest containing personal data of employees, executives, or clients, the corporate client acts as a Data Fiduciary regarding their recipients. The client affirms and warrants that:

• They have obtained lawful authorization, consent, or have valid statutory grounds under the DPDP Act to provide recipient contact details to Unboxd for corporate gift fulfillment.
• The data provided is accurate, current, and provided solely for the purpose of receiving the commissioned gift hampers.
• Unboxd processes such recipient data strictly as a service partner for the contracted gifting project.

5. Data Retention & Purpose-Bound Erasure

In compliance with the Data Minimization and Storage Limitation principles of the DPDP Act:

• Recipient Delivery Lists: Once a gifting project has completed dispatch, transit dispute windows (45 days post-delivery) have elapsed, and delivery reconciliations are finalized, all third-party recipient address spreadsheets and delivery lists are systematically and securely purged from our active operational systems.
• Corporate Invoicing Records: Commercial contracts, purchase orders, and GST invoices are retained strictly for the statutory duration mandated by the Ministry of Finance and Indian tax regulations.

6. Data Security & Confidentiality

We employ industry-standard technical, organizational, and physical safeguards to prevent unauthorized access, alteration, disclosure, or accidental destruction of personal data. Access to recipient manifests is strictly restricted to designated production, quality control, and dispatch personnel on a need-to-know basis.

7. Your Statutory Rights under the DPDP Act, 2023

As a Data Principal under the DPDP Act, you possess explicit rights regarding your digital personal data:

• Right to Access Information: Request confirmation on whether personal data is being processed, a summary of processed data, and identities of data fiduciaries/processors with whom it has been shared.
• Right to Correction & Erasure: Request correction of inaccurate or misleading data, completion of incomplete data, or erasure of data no longer necessary for the purpose it was collected.
• Right of Grievance Redressal: Avail of an accessible grievance redressal mechanism regarding our processing of your personal data.
• Right to Nominate: Nominate an individual who, in the event of death or incapacity, shall exercise your rights as a Data Principal.

9. Cookies & Storage Notice

The Unboxd website does not use third-party tracking cookies, fingerprinting libraries, or retargeting pixels. Ephemeral local storage is employed strictly for functional convenience — enabling custom hamper briefs built on /custom-hamper/ to populate the enquiry form on /contact/ without retaining personal data across separate browsing sessions.

10. Updates to this Policy

We may periodically update this policy to reflect statutory amendments, regulatory guidelines from the Data Protection Board of India, or operational enhancements. Updates will be published on this page with an updated effective date.