Privacy Policy

SOISU Furniture LLP ("SOISU", "we", "us", "our") operates www.soisu.com and the associated Standard Bespoke ordering service.

Registered name: SOISU Furniture LLP GSTIN: 27ABLCS2734D1ZD Address: 4th Floor, Orbit Plaza, New Prabhadevi Road, Prabhadevi, Mumbai – 400025, Maharashtra, India Privacy contact: sale@soisu.com

This Privacy Policy explains how we collect, use, store and protect your personal information when you use our website or engage our services. It applies to all visitors, enquirers and customers.

We collect personal data in two ways — directly from you, and automatically from your device.

Data you provide directly: — Name, phone number, WhatsApp number and email address when you fill our contact or quote form — City and room/property details when shared voluntarily as part of a design consultation — Payment information processed via Razorpay (we do not store card numbers — Razorpay holds this securely) — Delivery address when placing an order

Data collected automatically: — IP address and approximate location (city-level via IP) — Browser type, operating system and device type — Pages visited, time spent, scroll depth and clicks (via Google Analytics 4 and Google Tag Manager) — Referral source (how you arrived at our website) — Cookies and similar tracking technologies (detailed in Section 6)

We do not collect sensitive personal data such as Aadhaar numbers, financial account numbers, biometric data, health data or political opinions.

We use the personal data we collect for the following purposes:

Enquiry handling and sales: to respond to your quote request, answer product questions and guide you through the Standard Bespoke ordering process. This is our primary purpose and the core reason we collect your contact details.

Order fulfilment: to process your payment via Razorpay, arrange delivery, send dispatch updates via WhatsApp, and provide post-delivery support.

Marketing (with consent): if you have made an enquiry or purchase, we may send you updates about new collections, offers or relevant content via WhatsApp or email. You can opt out at any time by replying "STOP" or contacting us directly.

Analytics and improvement: to understand how visitors use our website, which pages perform well, and where we can improve the user experience. This uses anonymised, aggregated data from Google Analytics 4.

Advertising and remarketing: we use the Meta Pixel (ID: 1038318534392246) to measure the effectiveness of our advertising on Facebook and Instagram, and to show relevant ads to people who have visited our website. We also use Meta Conversions API (server-side) to improve the accuracy of this measurement. See Section 5 for details.

Legal compliance: to meet our obligations under Indian law including GST invoicing, consumer protection regulations, and — where applicable — court or regulatory orders.

Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable privacy principles, we process your personal data on the following bases:

— Consent: for marketing communications, Meta Pixel tracking and non-essential cookies. You may withdraw consent at any time. — Contract: to fulfil your order, arrange delivery and provide warranty service. — Legitimate interests: for website analytics, fraud prevention and improving our products and services. We ensure these interests do not override your fundamental rights. — Legal obligation: for GST invoicing, regulatory compliance and responding to lawful requests from Indian authorities.

We use the following third-party services. Each operates under its own privacy policy.

Meta (Facebook / Instagram) We use the Meta Pixel (browser-side) and Meta Conversions API (server-side) to measure advertising performance and enable remarketing. This involves transmitting hashed (SHA-256) versions of your phone number, name and city to Meta's servers when you submit our contact form. Meta's privacy policy: https://www.facebook.com/privacy/policy/

Google Analytics 4 & Google Tag Manager We use GA4 to analyse website traffic. Data is anonymised and aggregated. We do not share personally identifiable information with Google via Analytics. Google's privacy policy: https://policies.google.com/privacy

Google Tag Manager Used to manage tracking and analytics scripts on our website. Does not collect personal data directly.

Razorpay Payment processing. Razorpay is a PCI-DSS compliant payment gateway registered in India. We do not store your card or bank details. Razorpay's privacy policy: https://razorpay.com/privacy/

Netlify Our website is hosted on Netlify (USA). Netlify processes server logs including IP addresses. Netlify is SOC 2 Type II certified. Netlify's privacy policy: https://www.netlify.com/privacy/

Cloudinary Product images are served via Cloudinary's CDN. Cloudinary processes image delivery requests. Cloudinary's privacy policy: https://cloudinary.com/privacy

Resend (email notifications) If you submit our contact form, our server sends a notification email via Resend. Resend processes your name, phone and message for this purpose. Resend's privacy policy: https://resend.com/legal/privacy-policy

WhatsApp (Meta) Our primary customer communication channel. When you initiate a WhatsApp conversation with us, Meta processes your messages under WhatsApp's terms of service.

Our website uses the following types of cookies and tracking:

Essential cookies: required for the website to function. Cannot be disabled. These include session management and security cookies.

Analytics cookies: Google Analytics 4 uses cookies (including _ga, _gid) to track visits and measure page performance. These are anonymised and do not identify you personally.

Advertising cookies: Meta Pixel sets cookies (_fbp, _fbc) to track visits and enable advertising on Facebook and Instagram. These are set only after the page loads and require your browser to load the Meta script.

You can manage cookies through your browser settings. Blocking advertising cookies will not affect your ability to browse the site or submit enquiries. Note that blocking tracking cookies does not prevent server-side measurement via Meta Conversions API (CAPI), which operates independently of browser cookies.

We do not use cookie consent banners at this time because our primary audience is in India where the Cookie Law Directive does not apply. Under India's DPDP Act, we rely on legitimate interests for analytics and contract performance for essential functions. We will update this policy if requirements change.

Your personal data is stored on Netlify's servers (USA) and in our internal CRM (Zoho CRM, India servers). We retain your data as follows:

— Enquiry data (name, phone, city, message): retained for 3 years from last contact, or until you request deletion. — Order data (delivery address, payment history): retained for 8 years to comply with GST and accounting obligations under Indian law. — Analytics data: retained per Google Analytics settings (default 14 months for user-level data). — Meta Pixel data: retained per Meta's data retention policies.

We implement reasonable technical and organisational measures to protect your personal data against unauthorised access, loss or disclosure, including HTTPS encryption, access controls and our use of reputable third-party processors.

Under India's Digital Personal Data Protection Act, 2023 and general privacy principles, you have the following rights regarding your personal data:

Right to access: request a copy of the personal data we hold about you. Right to correction: request correction of inaccurate or incomplete personal data. Right to erasure: request deletion of your personal data, subject to our legal obligations to retain certain records. Right to withdraw consent: withdraw consent for marketing or non-essential processing at any time. Right to grievance redressal: lodge a complaint about how we handle your personal data.

To exercise any of these rights, contact us at sale@soisu.com or WhatsApp +91 90824 19824. We will respond within 30 days. For unresolved complaints, you may contact the Data Protection Board of India once operational under the DPDP Act.

Our website and services are not directed to children under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

Some of our third-party service providers (Meta, Google, Netlify, Cloudinary) are based outside India and process data on servers in the USA and elsewhere. By using our website and services, you consent to your personal data being transferred to and processed in these countries.

We take reasonable steps to ensure that overseas recipients protect personal data to a standard comparable to India's DPDP Act, including selecting established providers with published privacy commitments and certifications.

We may update this Privacy Policy at any time. The current version is always available at www.soisu.com/privacy-policy with the date of last update. Significant changes will be communicated via a notice on the website or via email/WhatsApp to active customers.

For privacy questions, data requests or complaints:

Privacy / Grievance Officer: Rohan Shah SOISU Furniture LLP 4th Floor, Orbit Plaza, New Prabhadevi Road Prabhadevi, Mumbai – 400025 Email: sale@soisu.com Phone: +91 90824 19824

We aim to respond to all privacy requests within 30 days.