Privacy Policy

1.  Who we are and our role

Clays Luxury Media Private Limited (CIN U18112DL2026PTC468312), registered office A-57, DDA Sheds, Phase-II, Okhla Industrial Estate, New Delhi 110020, India, is the Data Fiduciary in respect of the personal data described in this policy. Under the UK and EU GDPR the equivalent role is that of controller.

Our contact point for all privacy matters is privacy@claysluxury.com.

 

2.  The data we collect

Data you give us

• Identity and contact details: your name, organisation, job title, email address, telephone number and postal address, where you supply them through an enquiry form, a newsletter sign-up, a careers enquiry, or ordinary correspondence with us.

• The content of your message, including any brief, proposal, portfolio or attachment you choose to send.

• Details of any commercial relationship between us, including correspondence, meeting notes and contractual records.

 

Data collected automatically

• Technical data: IP address, approximate location derived from it, browser type and version, device type, operating system, and language settings.

• Usage data: the pages you visit, the order in which you visit them, time spent, referring source, and interactions such as clicks and form submissions.

 

Automatically collected data is gathered through cookies and similar technologies, which are described in section 6. Where your consent is required for that collection, we ask for it before the relevant cookies are set.

Data we do not seek

 

We do not seek sensitive categories of personal data through this site, including data about health, religion, caste, sexual orientation, political opinion, biometric or genetic characteristics, or financial account details. Please do not send them to us unsolicited. If you send them anyway, we will delete them unless there is a clear and lawful reason to retain them.

 

3.  Why we use it, and on what basis

Under the DPDP Act 2023 we process personal data either with your consent or, where the Act permits it, for a legitimate use such as responding to a request you have voluntarily made. Under the UK and EU GDPR we rely on consent, on the performance of a contract, on legitimate interests, or on compliance with a legal obligation, as set out below.

• To answer your enquiry and to correspond with you about a possible engagement. Basis: your voluntary provision of the data for that purpose, and our legitimate interest in responding to approaches made to our business.

• To provide services under an agreement, and to administer that relationship. Basis: performance of a contract.

• To send you editorial updates, invitations and news, where you have asked to receive them. Basis: your consent, which you may withdraw at any time.

• To understand how the site is used and to improve it. Basis: your consent to analytics cookies.

• To maintain records, meet statutory obligations under Indian company, tax and employment law, and to establish, exercise or defend legal claims. Basis: legal obligation and legitimate interest.

 

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we do not sell personal data.

 

4.  Who we share it with

 

We do not share personal data with third parties for their own marketing purposes. We do share it with service providers who process it on our instructions and under contract:

• Wix.com Ltd, which hosts the site and provides its forms and analytics infrastructure.

• Microsoft Corporation, whose Microsoft 365 services host our email, documents and internal collaboration.

• Our consent management provider, which records your cookie preferences.

• Analytics providers, where you have consented to analytics cookies.

• Professional advisers, including our lawyers, accountants and auditors, where they need the data to advise us.

 

We may also disclose personal data where we are required to do so by law, by a court, or by a regulator or law enforcement agency acting within its powers, and in connection with a sale, reorganisation or transfer of our business or assets, in which case the recipient will be bound by this policy.

 

5.  Transfers outside India

 

Our service providers operate globally, so your personal data may be stored or processed outside India, including in the European Economic Area, the United Kingdom, Israel and the United States. Transfers are made in accordance with section 16 of the DPDP Act 2023 and, where the UK or EU GDPR applies, under standard contractual clauses or another lawful transfer mechanism. Details of the mechanism relied on in any particular case are available from privacy@claysluxury.com.

 

6.  Cookies and similar technologies

 

A cookie is a small text file placed on your device by a website. We use four categories:

• Essential cookies, which are necessary for the site to function, to keep it secure and to remember your cookie preferences. These are set without consent because the site cannot work without them.

• Functional cookies, which remember choices such as language and improve the experience.

• Analytics cookies, which tell us how the site is used in aggregate.

• Advertising cookies, which would be used to measure the effect of any campaign we run. We do not currently run advertising on this site.

 

When you first visit, a banner asks you to accept all cookies, reject non-essential cookies, or set your own preferences. Essential cookies aside, nothing is set until you choose. You can change your choice at any time using the privacy settings icon on the site, or by clearing cookies in your browser. Most browsers also allow you to block cookies altogether, though parts of the site may then not work as intended.

 

7.  How long we keep it

 

We keep personal data only for as long as the purpose for which it was collected still exists, and then for any further period required by law.

• Enquiries that do not lead to a relationship: up to 24 months from the last contact, after which they are deleted.

• Client and supplier records: for the life of the relationship and then for eight years, in line with the record-keeping requirement under section 128 of the Companies Act 2013 and Indian tax law.

• Newsletter and invitation lists: until you withdraw consent, and then only a suppression record sufficient to ensure we do not contact you again.

• Website analytics: in aggregate and non-identifiable form after 14 months.

 

8.  Security

 

We apply reasonable security safeguards to protect personal data, including encryption in transit, access controls on our Microsoft 365 tenant, multi-factor authentication for all staff accounts, and restriction of access to those who need it. No transmission over the internet is completely secure, and we cannot guarantee the security of data sent to us before it reaches us. In the event of a personal data breach we will notify the Data Protection Board of India and affected individuals as required by the DPDP Act 2023, and any other regulator to which we are answerable.

 

9.  Your rights

 

As a Data Principal under the DPDP Act 2023 you have the right:

• To obtain a summary of the personal data we hold about you and of how we process it.

• To have inaccurate or incomplete data corrected, completed or updated.

• To have data erased where it is no longer needed for the purpose for which it was collected and there is no legal reason to retain it.

• To withdraw consent at any time, with the same ease as it was given. Withdrawal does not affect the lawfulness of processing before withdrawal.

• To nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

• To have a grievance addressed by us in the first instance, and to complain to the Data Protection Board of India if you are not satisfied with our response.

 

If the UK or EU GDPR applies to you, you additionally have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your national supervisory authority, including the Information Commissioner’s Office in the United Kingdom.

To exercise any of these rights, write to privacy@claysluxury.com. We will respond within 30 days. We may need to verify your identity before acting, and we will tell you if we need more time and why.

 

10.  Your responsibilities

Section 15 of the DPDP Act 2023 places duties on Data Principals as well. Please give us accurate information, do not impersonate anyone else, and do not raise frivolous or false grievances. The Act provides for penalties where these duties are breached.

 

11.  Children

 

This site is not directed at children. We do not knowingly collect the personal data of anyone under 18 without the verifiable consent of a parent or lawful guardian, and we do not track children, serve them advertising, or profile them. If you believe a child has given us personal data, write to privacy@claysluxury.com and we will delete it.

​

12.  Grievance Officer

 

If you are unhappy with how we have handled your personal data, contact our Grievance Officer:

​

Gitanjali Puljal, Grievance Officer

Clays Luxury Media Private Limited, A-57, DDA Sheds, Phase-II, Okhla Industrial Estate, New Delhi 110020, India

privacy@claysluxury.com  ·  +91 70428 33994

​

We will acknowledge your grievance within seven days and respond substantively within 30 days. If you remain dissatisfied you may complain to the Data Protection Board of India.

​

13.  Changes

 

We may update this policy. The version in force is the one on this page and the effective date is shown at the top. Where a change materially affects how we use your personal data, we will bring it to your attention rather than rely on the updated page alone.