Who we are
Artessa ("Artessa", "we", "us", "our") is a brand of VENETIAN IMAGE PVT. LTD., a company registered in India with its registered office at Delhi and GSTIN [GSTIN]. We design and manufacture mirrors and lighting in-house and sell them to individual and trade customers through our website and connected channels.
For the purposes of India's data protection law, Artessa is the Data Fiduciary responsible for the personal data described in this policy — meaning we decide why and how your data is handled. If you have any questions, our contact and grievance details are in section 15.
Scope of this policy
This policy applies whenever you interact with Artessa — when you browse or buy on our website, place an order or enquiry, message us on WhatsApp Business, email or call us, or engage with our advertising and social channels.
It is framed under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the "DPDP framework"), read with the Information Technology Act, 2000 and its Reasonable Security Practices Rules, 2011, which continue to govern data protection in India during the DPDP framework's phased rollout.
Information we collect
Information you give us
- Identity & contact — name, email address, phone number, and (for trade accounts) company name, GSTIN, and role.
- Order & delivery — shipping and billing addresses, order and enquiry details, product customisation notes, and installation preferences.
- Communications — messages you send us by WhatsApp Business, email, phone, contact form, or social media, including photos you share for custom or warranty requests.
- Reviews & feedback — any review, rating, or feedback you choose to submit.
Information collected automatically
- Device & usage — IP address, browser and device type, pages viewed, and how you move through the site.
- Cookies & similar technologies — as described in section 6.
Information from others
- Payment status — from our payment processors (we receive confirmation of payment and limited transaction details, not your full card or bank credentials — see section 7).
- Delivery updates — from our courier partners regarding dispatch and delivery.
- Advertising & analytics — aggregated or pseudonymised signals from platforms such as Meta and analytics providers.
How we use your information
We use your personal data only for defined, legitimate purposes:
- To fulfil your order — manufacturing your made-to-order piece, processing payment, arranging delivery and installation, and issuing invoices.
- To keep you informed — sending order confirmations, production and dispatch updates, and delivery tracking, including via WhatsApp Business.
- To support you — answering enquiries, handling customisation, warranty, replacement, and after-sales requests.
- To request reviews — inviting feedback from customers whose orders have been delivered.
- To improve the shop — understanding how the site is used so we can improve products, content, and the buying experience.
- To market, where you allow it — sending offers and new-launch news through channels you've consented to, which you can opt out of at any time.
- To protect the business — preventing fraud and misuse, and keeping our systems secure.
- To meet legal obligations — tax, accounting, and other statutory requirements.
Consent & its withdrawal
Where the DPDP framework requires it, we process your personal data on the basis of your consent, which you give when you place an order or enquiry, opt into messages, or otherwise choose to share your data with us. For certain purposes — such as fulfilling a transaction you've asked for or meeting a legal duty — we may process data as a "legitimate use" permitted by law.
You can withdraw consent at any time. Withdrawing is as easy as giving consent — reply STOP to a marketing message, adjust your preferences, or write to our Grievance Officer (section 15). Withdrawing consent won't affect processing already carried out, and some data may still be retained where the law requires it.
Cookies & tracking
Our website uses cookies and similar technologies to work properly and to help us understand and improve it:
- Essential cookies — needed for the cart, checkout, and account to function. These can't be switched off.
- Analytics cookies — help us see how the site is used, in aggregate.
- Advertising cookies — used by platforms such as the Meta pixel to measure and improve the relevance of our ads.
You can control cookies through your browser settings and, where offered, through our cookie banner. Blocking some cookies may affect how parts of the site work.
How we share information
We share personal data only with parties who help us run Artessa, and only as far as they need it. These act as our Data Processors under contract:
- E-commerce platform — Shopify, which hosts our store and processes order and account data on our behalf.
- Payment processors — our secure payment gateway, who handle your payment securely. Your full card or banking credentials are entered with them, not stored by us.
- Courier & logistics partners — such as Delhivery, Blue Dart, and DTDC, to deliver your order and provide tracking.
- Communication tools — WhatsApp Business and email providers used to send you updates.
- Advertising & analytics providers — such as Meta, used to measure and improve our marketing.
- Professional & statutory — accountants, auditors, legal advisers, and government or regulatory authorities where the law requires disclosure.
- Business transfers — if Artessa is involved in a merger, acquisition, or restructuring, data may transfer as part of that, subject to this policy.
How long we keep it
We keep personal data only for as long as it's needed for the purpose it was collected, and for any period the law requires afterwards.
- Order & tax records — retained for the periods required under Indian tax and company law.
- Account & contact data — kept while your relationship with us is active, and for a reasonable period after.
- Logs & transaction records — retained for at least the minimum period required under the DPDP framework.
When data is no longer needed and no legal duty requires us to keep it, we securely delete or anonymise it. You can ask us to erase your data as described in section 11.
Data stored outside India
Some of our service providers — including Shopify and certain communication and analytics tools — may store or process data on servers located outside India. Where this happens, we take reasonable steps to ensure your data remains protected in line with this policy and applicable law. The DPDP framework permits such transfers except to any country or entity the Government of India may restrict.
How we protect it
We use reasonable security safeguards — including access controls, encryption in transit where appropriate, and restricting data to staff and partners who need it — to protect your personal data against unauthorised access, loss, or misuse.
No method of transmission or storage is completely secure, so while we work hard to protect your data, we can't guarantee absolute security. If a data breach occurs that affects you, we'll act promptly and notify you and the relevant authority as required by law.
Your rights
Under the DPDP framework, you have the right to:
- Access — a summary of the personal data we hold about you and how we've processed it.
- Correction & completion — correct, complete, or update inaccurate data.
- Erasure — ask us to delete your data where it's no longer needed and no law requires us to keep it.
- Withdraw consent — at any time, as described in section 5.
- Grievance redressal — raise a concern with us and receive a response.
- Nomination — nominate another person to exercise your rights in the event of your death or incapacity.
To exercise any of these, contact our Grievance Officer (section 15). We'll verify your request and respond within the timelines required by law — and in any case within 90 days.
Children's data
Artessa's products and website are intended for adults. We don't knowingly collect the personal data of anyone under 18 without verifiable consent from a parent or lawful guardian. If you believe a child has provided us data, please contact us and we'll take appropriate steps to remove it.
Third-party links
Our site and messages may link to other websites — for example, payment pages, courier tracking, or social platforms. This policy doesn't cover those sites, and we're not responsible for their practices. We'd encourage you to read their privacy policies before sharing your data with them.
Changes to this policy
We may update this policy from time to time as our practices or the law evolve. The "last updated" date at the top shows when it last changed. For significant changes, we'll take reasonable steps to let you know. Continuing to use Artessa after an update means you've seen the current version.
Contact & grievances
If you have questions about this policy, or want to exercise your rights or raise a concern, our Grievance Officer is here to help.
If you're not satisfied with our response, you may escalate your concern to the Data Protection Board of India, established under the DPDP Act, 2023.