Privacy Policy

Last Updated: July 2026

ONARIS BRANDS PRIVATE LIMITED ("Company", "CUNIN", "we", "our", "us"), with its registered office at Shop-021, Jagat Plaza-II, Jagat Farm, Alpha, Greater Noida, Gautam Buddha Nagar - 201310, Uttar Pradesh, operates the website/application www.cunin.in (the "Platform"). We respect the privacy of our users and are committed to protecting the personal information shared with us.

This Privacy Policy explains how we collect, use, store, disclose, and protect personal information in accordance with applicable Indian laws, including the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules framed thereunder, and the Information Technology Act, 2000 and its applicable rules. This Privacy Policy also serves as the notice contemplated under the DPDP Act.

This Privacy Policy is incorporated into and forms part of our Conditions of Use. By creating an account, placing an order, or otherwise affirmatively indicating your acceptance , you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy. Where consent is the basis of processing, you may withdraw it at any time as described in Section 9 below.

1. Information We Collect

We may collect the following categories of personal information:

• Name, email address, and phone number

• Shipping and billing address

• Date of birth or age confirmation, where required

• Order and transaction details, including purchase history and preferences

• Communications with customer support, including reviews, feedback, and other content you submit

• Device, browser, IP address, and usage information

• Information collected through cookies and similar technologies for analytics and Platform functionality

We do not knowingly collect sensitive personal data such as biometric information, health data, financial account passwords, or Aadhaar details. We endeavour to make clear which fields are mandatory and which are optional; you may choose not to provide certain information by opting not to use the relevant service or feature.

2. Purposes of Collection and Use

Personal information is collected and used for the following purposes:

• Processing and fulfilling orders, including deliveries, returns, and refunds

• Managing payments and preventing, detecting, and investigating fraudulent or unlawful activity

• Providing customer support and resolving queries and grievances

• Sending transactional communications relating to your orders and account

• Sending promotional and marketing communications, subject to your consent and your right to opt out

• Personalising and improving the Platform, our products, and your user experience

• Enforcing our Conditions of Use and other policies

• Complying with applicable legal and regulatory requirements

3. Payment Information

All payments on the Platform are processed through secure third-party payment gateways. We do not store, process, or retain sensitive payment card or banking information on our own systems. Your payment information is handled by the relevant payment gateway in accordance with its own privacy policy and applicable payment security standards.

4. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Platform, remember your preferences, analyse traffic, measure the effectiveness of our marketing, and improve our services. These may include cookies placed by third-party analytics and advertising partners. You may manage or disable cookies through your browser settings; however, certain features of the Platform may not function properly without them.

5. Disclosure of Information

We may share personal information with the following categories of recipients, limited to the extent necessary for service delivery, business operations, and compliance:

• Payment gateway and financial service providers

• Logistics, courier, and delivery partners

• Technology, cloud hosting, CRM, analytics, and marketing service providers

• Our affiliates and group entities

We do not sell customer personal data.

Legal disclosures. We may disclose personal information where required by law, or in the good-faith belief that such disclosure is reasonably necessary to comply with subpoenas, court orders, or other legal process; to respond to lawful requests from government or law enforcement authorities; to enforce our Conditions of Use or this Privacy Policy; or to protect the rights, property, or safety of CUNIN, our users, or the public.

Business transfers. If we (or substantially all of our assets) merge with, are acquired by, reorganise, amalgamate, or otherwise restructure our business, we may transfer some or all of your personal information to the resulting or acquiring entity, which will remain bound by commitments substantially similar to this Privacy Policy.

6. Cross-Border Transfers

Some of our service providers (including cloud hosting, analytics, and marketing platforms) may store or process personal information on servers located outside India. Such transfers are made in accordance with the DPDP Act and any restrictions notified by the Government of India, and we take reasonable steps to ensure that your personal information receives an adequate standard of protection.

7. Data Security

We implement reasonable security practices and procedures to safeguard personal information, including access controls, encryption in transit where appropriate, and the use of secure servers and cloud-based systems, in line with applicable law. While we take reasonable measures to protect personal information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Data Retention

Personal information is retained only for as long as necessary to fulfil the purposes for which it was collected, or as required to comply with applicable legal, regulatory, tax, or accounting obligations. When personal information is no longer required, or upon valid withdrawal of consent where consent is the basis of processing, we will erase it or cause it to be erased, unless retention is required by law.

9. Your Rights

Subject to applicable law, including the DPDP Act, you have the right to:

• Access : obtain a summary of the personal information we process about you and the processing activities undertaken

• Correction and updating : have inaccurate or incomplete personal information corrected, completed, or updated

• Erasure : request deletion of personal information that is no longer necessary for the purpose for which it was collected, unless retention is required by law

• Withdraw consent : withdraw your consent at any time, with ease comparable to the manner in which it was given; withdrawal will not affect the lawfulness of processing carried out before withdrawal, and may result in our inability to provide certain services

• Grievance redressal : have your grievances relating to personal information addressed through the mechanism described in Section 12

• Nomination : nominate another individual to exercise your rights in the event of your death or incapacity

Requests to exercise these rights may be made using the contact details in Section 12. If you are not satisfied with our response, you may approach the Data Protection Board of India in accordance with the DPDP Act.

10. Marketing Communications and Opt-Out

We may communicate with you by email, SMS, RCS, WhatsApp, phone call, or push notification. Transactional communications relating to your orders and account will be sent regardless of your marketing preferences. You may opt out of promotional and marketing communications at any time by using the unsubscribe or opt-out mechanism provided in the communication, or by contacting us using the details in Section 12.

11. Children's Data

The Platform is intended for persons who can form a legally binding contract under the Indian Contract Act, 1872. We do not knowingly collect personal information from individuals under the age of 18 without verifiable parental or guardian consent, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If you believe a minor has provided us personal information without appropriate consent, please contact us using the details in Section 12 and we will take reasonable steps to delete such information.

12. Grievance Officer

In accordance with applicable law, the contact details of our Grievance Officer are as follows:

Amish Bibhu Designation: Founder, ONARIS BRANDS PRIVATE LIMITED Address: Shop-021, Jagat Plaza-II, Jagat Farm, Alpha, Greater Noida, Gautam Buddha Nagar - 201310, Uttar Pradesh Email: grievance@cunin.in Time: Mon - Fri (9:00 - 18:00)

We will acknowledge grievances within 24 hours and endeavour to resolve them within 15 days of receipt, or within such other period as may be prescribed under applicable law.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our information practices or applicable law. We will indicate the date of the most recent revision at the top of this page, and, where required by applicable law or where changes are significant, we will notify you by placing a notice on the Platform or by contacting you using the details you have provided. Your continued use of the Platform following the posting of changes constitutes acceptance of the revised Privacy Policy, save where fresh consent is required under applicable law.

14. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of India. Subject to the jurisdiction of any authority constituted under applicable data protection law, the courts at Delhi shall have jurisdiction over disputes arising out of or in connection with this Privacy Policy.