Legal & Trust

Privacy Policy

Notice under the Digital Personal Data Protection Act 2023 (DPDP Act, India)

Last updated: September 2026 · Effective for all visitors and customers of Aslihan Abaya

1. Data Fiduciary Identity

This digital storefront is owned and operated by Aslihan Abaya (“we”, “us”, “our”), acting as the Data Fiduciary in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) of India.

We respect your right to privacy and are committed to transparent, lawful, and purposeful handling of any digital personal data you share with us.

Privacy-by-Design Architecture

Our storefront operates on a zero-account, WhatsApp-direct architecture. We do not require you to register an account, create a password, or store your credit card or financial credentials on our web servers. Browsing our collection requires no personal data entry.

2. Personal Data We Collect & Process

We only process personal data that you voluntarily provide when initiating an order inquiry or bespoke consultation:

  • WhatsApp Contact Information: Your phone number and WhatsApp profile name when you click “Order on WhatsApp” or “Chat on WhatsApp”. This interaction is hosted end-to-end encrypted on WhatsApp/Meta Platforms.
  • Bespoke Garment Measurements: If you select “Custom Size”, your voluntarily provided garment dimensions (such as Length, Shoulder, Sleeves, Bust, and Hips) are formatted into a pre-filled WhatsApp message. These measurements are used solely by our atelier to tailor your garment.
  • Delivery Details: Shipping address, recipient name, and contact phone number shared during WhatsApp order confirmation for dispatching small-batch shipments through courier partners.
  • Strictly Necessary Session Data: We do not deploy advertising tracking pixels, cross-site profiling cookies, or third-party behavioral trackers. Our website uses only strictly necessary functional session storage for administrator management.

3. Lawful Grounds & Purpose of Processing

Under Section 4 and Section 7 of the DPDP Act 2023, we process personal data under:

  1. Specified Purpose (Consent): By voluntarily clicking our WhatsApp order links and messaging our atelier, you consent to our use of your details to respond to your inquiry, customize your piece, and fulfill your purchase.
  2. Legitimate Uses: Generating invoices, processing returns or alterations, and complying with statutory tax obligations under Indian law.

4. Third-Party Data Processors

In accordance with Section 5(2) of the DPDP Act, we disclose the third-party processors supporting our operations:

WhatsApp / Meta Platforms, Inc.

Facilitates order placement, customer service, and bespoke consultations. Protected by WhatsApp end-to-end encryption.

Cloudinary, Inc.

Content delivery network hosting product imagery and videos. No customer personal data is stored on Cloudinary.

MongoDB Atlas

Cloud database infrastructure storing product catalog, categories, and storefront copy. Does not store customer PII.

5. Your Rights as a Data Principal

The DPDP Act 2023 grants you fundamental statutory rights regarding your personal data:

  • Right to Access Information: Request a summary of personal data you have shared with us and the identities of any third parties it was shared with.
  • Right to Correction & Erasure: Request the correction of misleading or outdated data, or the deletion of your chat history and measurement records once your order has been delivered.
  • Right of Grievance Redressal: Have your complaints addressed through our designated Grievance Officer within statutory timeframes.
  • Right to Nominate: Nominate another individual to exercise your rights in the event of death or incapacity.

6. Data Retention & Erasure

We retain customer conversation logs and measurements on our secure business WhatsApp device only for as long as necessary to complete your order, facilitate potential order support or exchanges for damaged/incorrect items, and satisfy standard commercial accounting requirements.

You may at any time request immediate erasure of your measurements and contact history by emailing our Grievance Officer or messaging us directly on WhatsApp.

7. Protection of Children’s Data

In accordance with Section 9 of the DPDP Act 2023, our products and atelier are intended for individuals who are at least 18 years of age. We do not knowingly process personal data of minors without parental or lawful guardian consent.

8. Grievance Redressal Officer

Under Section 13 of the Digital Personal Data Protection Act 2023, Aslihan Abaya has appointed a designated Grievance Officer to address any privacy inquiries, requests for data erasure, or concerns:

Grievance Email: privacy@aslihanabaya.com
General Contact: contact@aslihanabaya.com
WhatsApp Support: Open WhatsApp Chat

We will acknowledge your grievance within 48 hours and resolve your request within 30 days as stipulated under the DPDP Act guidelines. If you are not satisfied with our resolution, you have the right to file a complaint with the Data Protection Board of India (DPBI).