Privacy Policy

1. Introduction

Crystal Design & Print (“we”, “us”, or “our”) respects your privacy and is committed to handling your personal data lawfully, fairly and transparently. This Privacy Policy is issued in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it, and serves as the notice required before we process your personal data.

It explains what personal data we collect when you visit our website, request a quote or place an order, why we collect it, who we share it with, how long we keep it, and the rights available to you as a Data Principal.

This policy applies to the processing of digital personal data collected within India, and to personal data collected outside India where it relates to offering goods or services to individuals in India.

2. Key Terms Used in This Policy

The DPDP Act uses specific terms, which we have adopted here so that this notice matches the language of the law:

• “Personal data” means any data about an individual who is identifiable by or in relation to such data.
• “Processing” means any operation performed on personal data — including collection, recording, storage, use, sharing, retention and erasure.
• “Data Principal” means you, the individual to whom the personal data relates. Where the individual is a child, it includes their parent or lawful guardian.
• “Data Fiduciary” means the person who determines the purpose and means of processing personal data. For the purposes of this policy, Crystal Design & Print is the Data Fiduciary.
• “Data Processor” means a person who processes personal data on our behalf — for example, our email delivery, analytics and hosting providers.

3. Personal Data We Collect, and Why

We collect only the personal data that is necessary for the specified purposes set out below. An itemised description follows:

• Enquiry and quote details — your name, email address, phone number and the message you submit through our contact form. Purpose: to identify you, respond to your enquiry, prepare a quote and follow up on it.
• Order and project details — artwork, design files, logos, text, delivery addresses, product specifications and preferences you share with us. Purpose: to produce and deliver the printing, design, gifting or digital services you have engaged us for.
• Communication records — messages exchanged with us by email, WhatsApp, telephone or our contact form. Purpose: to maintain a record of your instructions, approvals and our correspondence.
• Billing and transaction details — the information required to raise an invoice, such as billing name, address and GSTIN where applicable. Purpose: to invoice you and to meet our tax and accounting obligations.
• Technical and usage data — IP address, browser and device type, approximate location, referring page and pages visited on our website, collected through cookies and analytics tools. Purpose: to keep the website secure and to understand and improve how it is used.

4. The Basis on Which We Process Your Personal Data

Under the DPDP Act, we may process your personal data only for a lawful purpose, and only either with your consent or for a legitimate use permitted by the Act.

Consent: where we rely on consent, it is sought through a clear affirmative action — for example, submitting our contact form or agreeing to receive marketing messages. Your consent is free, specific, informed, unconditional and unambiguous, and is limited to the personal data necessary for the stated purpose. You may withdraw it at any time.

Legitimate uses: we may also process personal data for certain legitimate uses recognised by the Act — most commonly where you have voluntarily provided your personal data to us for a specified purpose and have not indicated that you object to its use for that purpose, and where processing is necessary to comply with a legal obligation or a judgment or order.

5. How We Use Your Personal Data

We use the personal data described above to:

• Prepare quotes and fulfil your printing, design, personalised gift and digital service orders.
• Communicate with you about your enquiries, proofs, orders, delivery and support.
• Raise invoices and maintain the financial records we are required by law to keep.
• Operate, secure, troubleshoot and improve our website and services.
• Send you offers, updates or marketing messages, but only where you have consented to receive them.
• Comply with applicable law and respond to lawful requests from public authorities.

6. Withdrawing Your Consent

You may withdraw your consent at any time, and we will make it as easy to withdraw as it was to give. To withdraw, write to us at crystaldesignprint@gmail.com with the subject line “Withdrawal of Consent”, or use the unsubscribe option in any marketing message.

On withdrawal, we will stop processing your personal data for the purpose concerned within a reasonable period, and will require our Data Processors to do the same, unless retention is required or permitted by law. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal, and it may mean we are no longer able to provide a service you have asked for.

You may also give, manage, review or withdraw your consent through a Consent Manager registered with the Data Protection Board of India, where you choose to use one.

7. Cookies, Analytics and Embedded Third-Party Content

Our website uses cookies and similar technologies, including Google Tag Manager and the analytics services configured through it, to understand how visitors use the site and to improve its performance. You can control or disable cookies through your browser settings, though some parts of the site may not function as intended without them.

Some pages embed content served by third parties — including a Google Reviews widget, images delivered through our image hosting providers, and links to our blog hosted on an external platform. When such content loads, the third party may receive your IP address and set its own cookies. That processing is governed by their privacy policies, not this one.

Our contact form is delivered through a third-party email service, which receives the details you submit in order to pass them to our inbox.

8. Sharing Your Personal Data

We do not sell your personal data, and we do not share it for any purpose you have not been told about. We share it only where necessary, and only with:

• Data Processors engaged by us under contract — including our website hosting, contact-form email delivery, analytics and communication providers — who may process personal data only on our instructions.
• Production and fulfilment partners — such as print, finishing and courier partners — strictly to the extent needed to complete and deliver your order.
• Professional advisers, such as our accountants and auditors, where required for invoicing, statutory filings and compliance.
• Public authorities, courts or regulators, where disclosure is required to comply with applicable law or an order of a court or tribunal.

9. Transfer of Personal Data Outside India

Some of the service providers we rely on to run this website — including analytics, contact-form email delivery and content hosting — process data on servers located outside India. Where personal data is transferred outside India, we do so in accordance with Section 16 of the DPDP Act and will not transfer personal data to any territory restricted by the Central Government by notification.

10. How Long We Keep Your Personal Data

We erase personal data once the purpose for which it was collected is no longer being served and retention is no longer necessary for legal or business purposes, and we require our Data Processors to do the same.

In practice this means: enquiry and quote correspondence is retained for up to 24 months from our last interaction with you, unless it becomes part of an order; order, artwork and project records are retained for the duration of the engagement and for a reasonable period afterwards to support reprints and warranty claims; and invoices, tax and accounting records are retained for the periods prescribed under applicable tax, GST and company law.

Where you withdraw consent and there is no other lawful basis or legal obligation requiring us to keep the data, we will erase it.

11. Security Safeguards

We take reasonable technical and organisational security safeguards to protect personal data in our possession or under our control, and to prevent a personal data breach. These include restricting access to those who need it, using reputable service providers, securing our website over HTTPS and keeping our systems and accounts protected.

No method of transmission or storage is completely secure, and while we work to protect your personal data, we cannot guarantee absolute security.

12. Personal Data Breach

In the event of a personal data breach, we will notify the Data Protection Board of India and each affected Data Principal in the form and manner prescribed under the DPDP Act and the rules made under it, without undue delay.

13. Children's Personal Data

Our website and services are intended for businesses and for individuals aged 18 and above, and are not directed at children.

Where we do process the personal data of a child or of a person with a disability who has a lawful guardian, we will obtain verifiable consent from the parent or lawful guardian before doing so. We do not undertake processing that is likely to cause any detrimental effect on the well-being of a child, and we do not carry out tracking, behavioural monitoring or targeted advertising directed at children.

If you believe a child has provided us personal data without the consent of a parent or guardian, please contact us and we will take steps to erase it.

14. Your Rights as a Data Principal

Subject to the DPDP Act, you have the following rights in respect of personal data processed on the basis of your consent or for certain legitimate uses:

• Right to access information — to obtain a summary of the personal data we process about you, the processing activities undertaken, and the identities of the Data Fiduciaries and Data Processors with whom it has been shared, along with a description of the data shared.
• Right to correction, completion, updating and erasure — to have inaccurate or misleading personal data corrected, incomplete data completed, data updated, and personal data erased where it is no longer necessary for the purpose it was collected for, unless retention is required by law.
• Right to grievance redressal — to a readily available means of registering a grievance with us about our performance of our obligations, and to have it responded to within the period prescribed under the Act.
• Right to nominate — to nominate another individual who may, in the event of your death or incapacity, exercise these rights on your behalf.

To exercise any of these rights, contact our Grievance Officer using the details in section 16. We may ask you for information reasonably needed to verify your identity before we act on a request.

15. Your Duties as a Data Principal

The DPDP Act also places certain duties on Data Principals. In particular, you must comply with applicable law when exercising your rights, must not impersonate another person when providing personal data, must not suppress any material information when providing personal data for any document or identity proof issued by the State, must not register a false or frivolous grievance or complaint, and must furnish only information that is verifiably authentic when seeking correction or erasure.

16. Grievance Redressal and the Data Protection Board

If you have any question, request or grievance about how we handle your personal data, please contact our Grievance Officer, who is the person able to answer questions about our processing on our behalf:

• Grievance Officer, Crystal Design & Print
• Email: crystaldesignprint@gmail.com
• Phone: +91 8588006158, +91 8586813939
• Address: Office No 1181, 11th Floor, Space, Mall Office, Greater Noida W Rd, Gaur City 1, Sector 4, Greater Noida, Ghaziabad, Uttar Pradesh 201318

We will acknowledge and respond to your grievance within the period prescribed under the DPDP Act and the rules made under it. If you are not satisfied with our response, or if we do not respond within that period, you may complain to the Data Protection Board of India in the manner provided under the Act.

17. Third-Party Links

Our website contains links to external sites that we do not operate, including our blog and our social media profiles. We are not responsible for the privacy practices or content of those websites, and we encourage you to review their policies before sharing personal data with them.

18. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. Any changes will be posted on this page with a revised “last updated” date. Where a change materially affects the purposes for which we process personal data collected with your consent, we will give you notice and, where required, seek fresh consent.

19. Contact Us

For any question about this Privacy Policy or how we handle your personal data, please contact us:

• Email: crystaldesignprint@gmail.com
• Phone: +91 8588006158, +91 8586813939
• Address: Office No 1181, 11th Floor, Space, Mall Office, Greater Noida W Rd, Gaur City 1, Sector 4, Greater Noida, Ghaziabad, Uttar Pradesh 201318