Privacy policy
Privacy Policy
HighSpark is a brand of Arara Jewels LLP ("HighSpark", "we", "us", "our"). We operate the website www.highsparksilver.com (the "Site") and sell sterling silver jewellery in India.
This policy explains what personal data we collect about you, why we collect it, who we share it with, how long we keep it, and the rights you have over it.
We are a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025. That means we decide why and how your personal data is processed, and we are accountable to you and to the Data Protection Board of India for it. Where you are outside India, section 12 of this policy sets out the additional rights that may apply to you.
We have written this policy to be read, not to be survived. If any part of it is unclear, write to our Grievance Officer at the address in section 13 and we will explain it in plain terms.
1. Your rights, first
Under the DPDP Act you have the following rights. We do not charge for exercising them.
| Right | What it means | How to use it |
|---|---|---|
| Right to access | Get a summary of the personal data we hold about you, what we are doing with it, and the identities of everyone we have shared it with | Email the Grievance Officer (section 13) |
| Right to correction and completion | Have inaccurate or misleading data corrected, incomplete data completed, and outdated data updated | Your account page, or email us |
| Right to erasure | Have your personal data deleted, unless we are required by law to keep it (see section 8) | Email the Grievance Officer |
| Right to grievance redressal | Complain to us first, and get a substantive response — not a holding reply | Section 13 |
| Right to nominate | Nominate another person to exercise these rights on your behalf if you die or become incapable of exercising them yourself | Email the Grievance Officer with the nominee's name and contact details |
| Right to withdraw consent | Withdraw consent at any time, and as easily as you gave it | Section 5 |
How we respond. We acknowledge every request within 48 hours and complete it within 30 days. If a request is complex and we need longer, we will tell you why before the 30 days are up, and in no case will we take longer than 90 days.
To protect you, we verify identity before acting. We will only act on a request that comes from the email address or phone number registered on the order or account, or that you can otherwise verify. This is to stop somebody else deleting or extracting your data.
If you are not satisfied with our answer, you may complain to the Data Protection Board of India. Details in section 13.
2. Personal data we collect
You give us:
- Identity and contact data — name, email address, phone number, and the shipping and billing addresses you enter at checkout.
- Order data — items ordered, order value, payment method chosen, delivery instructions, GST details if you supply them, and PAN where the law requires it for high-value orders.
- Account data — if you create an account: your login identifier, saved addresses, order history and wishlist.
- Warranty data — the serial number on your warranty card, purchase date, and the channel you bought from, when you register a product.
- Support and claims data — the content of your emails, WhatsApp messages and calls with us, and any photographs or unboxing videos you send us in support of a return, damage report or warranty claim.
- Returns data — the reason you give for a return, and the bank or UPI details you provide for a refund on a Cash on Delivery order.
We collect automatically when you use the Site:
- Device and connection data — IP address, browser type and version, operating system, device type, language and time zone.
- Usage data — pages and products viewed, search terms, referring website, what you added to cart, and how you moved through the Site.
- Advertising identifiers — click identifiers appended to the link that brought you to us (for example Google's `gclid` or `gbraid`, or Meta's `fbclid`), and the campaign parameters (`utm_source` and similar) in that link.
- Cookies and similar technologies — see our Cookie Policy.
We receive from others:
- Payment confirmation from the payment providers at checkout. We receive confirmation that a payment succeeded or failed, the method used, and a transaction reference. We never receive or store your full card number, CVV or UPI PIN.
- Delivery status from our courier partners — scan events, delivery attempts, delivery confirmation and the recipient's name where captured on delivery.
- Marketplace order data where you bought a HighSpark product on Amazon, Flipkart or Myntra and then contact us or register a warranty. In those cases the marketplace is the seller of record for the transaction and has its own privacy policy.
- Reviews you leave through our reviews provider.
We do not collect any data about your health, religion, caste, sexual orientation, political beliefs or biometrics. Please do not send us this information.
3. Why we process your data
| Purpose | Data used | Our basis |
|---|---|---|
| Take, pack, invoice and deliver your order | Identity, contact, order, address | Performance of our contract with you / your consent given at checkout |
| Process payments and prevent payment fraud | Order, device, payment confirmation | Contract and our legitimate interest in preventing fraud |
| Handle returns, exchanges, refunds and warranty claims | Order, returns, warranty, support | Contract and legal obligation |
| Answer your questions on email, phone and WhatsApp | Contact, support | Contract / your consent |
| Send order updates (dispatch, tracking, delivery, refund) | Contact, order | Contract — these are service messages, not marketing |
| Send offers, launches and promotions | Contact, usage | Your consent only. Withdraw any time — section 5 |
| Measure and improve our advertising | Usage, advertising identifiers, hashed email/phone, order value | Your consent — see section 9, including how to opt out today |
| Understand how the Site is used and improve it | Usage, device | Your consent — see section 9 |
| Detect and block bots, scrapers and abusive traffic | Device, usage | Legitimate interest in keeping the Site available and our pricing accurate |
| Meet tax, accounting, GST and company-law obligations | Order, identity, GST/PAN | Legal obligation |
| Establish, exercise or defend a legal claim | Whatever is relevant to the claim | Legal obligation and legitimate interest |
We do not use your personal data to make any decision about you that is fully automated and has a significant legal effect on you.
We do not sell your personal data. We have never sold it and we do not operate any arrangement under which a third party pays us for access to it.
4. Notice at the point of collection
The DPDP Act requires that you be told, at the moment you give us personal data, what it will be used for and how to withdraw consent. We do this through:
- the wording at each form where you enter data (checkout, warranty registration, newsletter sign-up);
- this policy, which is linked from every page of the Site; and
- a cookie consent banner, which we are currently implementing. Until it is live, section 9 sets out exactly how to opt out of advertising and analytics in the meantime.
Available in your language. On request, we will provide this policy in English or in any language listed in the Eighth Schedule to the Constitution of India. Ask the Grievance Officer.
5. Consent, and how to withdraw it
Where we rely on your consent, you can withdraw it at any time — and it is as easy to withdraw as it was to give:
| To stop | Do this |
|---|---|
| Marketing emails | Click Unsubscribe in any marketing email, or email us |
| Marketing WhatsApp messages | Reply STOP to any marketing WhatsApp message |
| Marketing SMS | Reply STOP |
| Analytics and advertising cookies | Email the Grievance Officer — see section 9 and the Cookie Policy |
| Use of your email or phone for advertising audiences | Email the Grievance Officer and ask us to suppress you — section 9 |
| Everything | Email the Grievance Officer and ask us to erase your data — section 1 |
What withdrawal does not undo. Withdrawing consent stops future processing. It does not make past processing unlawful, and it does not stop us keeping records that tax law, company law or an ongoing legal claim require us to keep (see section 8). If you withdraw consent while an order is in flight, we may need to keep processing your address and phone number until that order is delivered or refunded.
We will not degrade your service for saying no. Refusing marketing or analytics consent does not affect your ability to buy, return, refund or claim warranty.
6. Who we share your data with
We share personal data only with the organisations below, only for the purposes listed, and only to the extent each one needs. Each is bound by contract to protect it and to use it only on our instructions.
| Who | Country | What they receive | Why |
|---|---|---|---|
| Shopify Inc. | Canada / USA / Ireland | Account, order, contact, address, usage | Hosts the Site, checkout and customer accounts |
| Amazon Web Services | India (Mumbai) | Order, contact, address, warranty, support | Hosts our order management system and database |
| GoKwik | India | Contact, address, order, device | Checkout, Cash on Delivery verification and order-risk scoring |
| Payment providers shown at checkout | India | Payment amount and reference; card/UPI data goes to them directly, not through us | Take your payment |
| Blue Dart Express Limited | India | Name, delivery address, phone, order reference | Deliver your order and accept returns |
| Shiprocket | India | Name, delivery address, phone, order reference | Courier allocation and delivery |
| Unicommerce eSolutions | India | Order, address, contact | Order management and dispatch across sales channels |
| Return Prime | India | Order, contact, return reason, refund details | Run our returns and exchange process |
| Zoho Mail / Amazon SES | India / USA | Email address, message content | Send and receive order, warranty and support email |
| Google (Gmail) | USA | Content of any grievance or escalation you send us | Hosts the mailbox our Grievance Officer monitors |
| KwikEngage | India | Phone number, order status | Send WhatsApp order updates and, with consent, offers |
| Judge.me | USA / EU | Name, email, order reference | Invite and publish product reviews |
| Google LLC (Ads, Analytics, Merchant Center) | USA | Usage, advertising identifiers, order value, hashed email and phone — see section 9 | Advertising measurement and Site analytics |
| Meta Platforms (Facebook, Instagram) | USA | Usage and advertising identifiers | Advertising measurement |
We also disclose personal data:
- to professional advisers — our chartered accountants and lawyers, under a duty of confidentiality;
- to a buyer if our business or part of it is sold or restructured, in which case we will tell you before your data is transferred and the buyer will be bound by this policy or an equivalent one; and
- where the law requires it — to a court, tax authority, police or other government agency acting under a lawful order. We will tell you when this happens unless we are legally barred from doing so.
That is the complete list. If we add a processor, we will update this table.
7. Where your data is stored, and transfers outside India
Your order, warranty, support and inventory records are stored on Amazon Web Services infrastructure in Mumbai, India.
Some of the organisations in section 6 process data outside India — principally Shopify (Canada, USA, Ireland), Google and Meta (USA), and Judge.me (USA / EU). Where that happens:
- the transfer is limited to what that provider needs for the purpose listed;
- it is governed by that provider's data processing terms, including standard contractual clauses where applicable; and
- it is made only to countries that the Government of India has not restricted for this purpose under section 16 of the DPDP Act. If a country we use is restricted in future, we will stop transferring to it.
8. How long we keep your data
| Record | Kept for | Why |
|---|---|---|
| Orders, invoices, GST and payment records | 8 financial years from the end of the financial year of the transaction | Income-tax, GST and company/LLP law require it. We cannot delete these on request |
| Account and address book | While your account is open, then 3 years after your last order or login | So you can reorder; then deleted |
| Warranty registrations and claims | Warranty period + 3 years | To honour and evidence claims |
| Returns, refunds and the bank/UPI details given for a COD refund | 8 financial years (payment record); bank/UPI details deleted 90 days after the refund settles | Financial record; the account details themselves are not needed after settlement |
| Support email, WhatsApp and call records | 3 years from the last message | To handle repeat issues and disputes |
| Photographs and videos you send for a claim | 3 years from resolution | Evidence of the claim |
| Website analytics and session data | 24 months | Trend analysis |
| Advertising audience lists (hashed email/phone) | 540 days, then automatically expire | This is the configured lifespan of our advertising audience lists |
| Marketing consent and unsubscribe records | Until withdrawn, plus 3 years | To prove we had consent, and to keep you unsubscribed |
| Cookie consent choices | 12 months, then we ask again | So your choice is honoured, and refreshed |
When a retention period ends we delete the data or irreversibly anonymise it so it can no longer identify you.
If you ask us to erase your data and we are legally required to keep part of it, we will delete everything we are not required to keep, tell you exactly what remains and under which law, and delete the rest when that period ends.
9. Advertising, analytics and hashed identifiers
We advertise on Google and Meta. To know which advertising actually leads to sales — rather than guessing — we do the following.
We are currently implementing a cookie consent banner. Until it is live, advertising and analytics cookies are set by default when you visit. You can opt out at any time by emailing our Grievance Officer (section 13), and we will suppress you from all advertising measurement permanently. We will action a suppression request within 7 days.
- Click identifiers. When you arrive from an ad, the link carries an identifier. We store it against your session so that if you later buy, we can attribute the sale to that ad.
- Conversion values. We report the value of the order to the advertising platform. We report the value recorded in our own order system, not an estimate.
- Hashed identifiers. We send Google an irreversibly hashed (SHA-256) version of your email address and phone number alongside a purchase, so Google can match the sale to an ad click that our own records lost. Google receives the hash, not the address or number itself, and under its contract with us may use it only for our measurement. We do this only where the order shows evidence of a Google ad interaction, and never where you have asked us to suppress you.
- Retraction. If you cancel your order, it is refunded, or the courier returns it undelivered, we send a correction so the advertising platform stops counting a sale that did not happen.
To opt out of all of this: email the Grievance Officer and ask to be suppressed from advertising audiences. Suppression is permanent until you ask us to reverse it. Once our consent banner is live, you will also be able to decline advertising cookies directly on the Site.
You can also control advertising directly at the platforms:
- Google: myadcenter.google.com and tools.google.com/dlpage/gaoptout
- Meta: facebook.com/adpreferences
- Industry opt-out: optout.aboutads.info
Do Not Track. Browsers send a "Do Not Track" signal that has no agreed industry meaning, so we do not act on it. Email us instead — that we do act on.
10. Children
The Site is meant for adults. We do not knowingly sell to, or collect personal data from, anyone under 18.
In line with the DPDP Act, we do not track the behaviour of children or direct advertising at children.
If you are a parent or guardian and believe your child has given us personal data, write to the Grievance Officer. We will verify the position and delete the data.
11. Security, and what happens if something goes wrong
We protect your data with, among other measures: encryption in transit (HTTPS/TLS) and at rest; a private database not reachable from the public internet; role-based access so staff see only what their job needs; multi-factor authentication on administrative accounts; audit logging of access to personal data; and vendor contracts that impose equivalent obligations.
No system is perfectly secure, and we will not claim otherwise. If a personal data breach affects you, we will:
- tell you without delay, describing in plain language what happened, what data was involved, what the likely consequences are, what we are doing about it, and what you should do;
- report it to the Data Protection Board of India without delay, and give the Board a full report within 72 hours; and
- tell you afterwards what we changed so it does not happen again.
Please help us by using a strong, unique password and by telling us immediately if you think your account has been accessed by someone else.
12. If you are outside India
Our Site is aimed at customers in India, but we recognise that some visitors are not.
- European Economic Area / United Kingdom. You have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR/UK GDPR, and the right to complain to your national supervisory authority. Our lawful bases are those set out in section 3.
- California. You have the right to know what personal information we collect and disclose, the right to delete it, the right to correct it and the right to opt out of "sale" or "sharing" as those terms are defined by the CCPA/CPRA. We do not sell personal information. Our advertising described in section 9 may constitute "sharing"; decline advertising cookies to opt out. We will not discriminate against you for exercising these rights.
Use the same contact route in section 13 for these requests.
13. Grievance Officer, and how to escalate
Under section 8(9) of the DPDP Act and Rule 9 of the DPDP Rules, 2025, and under Rule 4(5) of the Consumer Protection (E-Commerce) Rules, 2020, we publish the following contact.
Grievance Officer Sail Arara Jewels LLP 209, 93 Avenue Mall, Solapur Road, Pune 411022, Maharashtra, India
Email: grievance@highsparksilver.com Phone: +91 91450 00110 (Monday to Friday, 11:00 to 17:00 IST)
Our commitment: acknowledgement within 48 hours, and a substantive resolution within 30 days, and never more than 90 days.
If we do not resolve it:
- On a data protection matter, complain to the Data Protection Board of India — dpb.gov.in. You may complain to the Board after raising it with us first.
- On a consumer matter (delivery, refund, product quality), you may approach the National Consumer Helpline on 1915 or consumerhelpline.gov.in, or the consumer commission with jurisdiction — including the one where you reside or work. Nothing in our policies takes that right away from you.
14. Changes to this policy
We will update this policy when our practices change. When we make a change that materially affects your rights or how we use your data, we will tell you by email or by a notice on the Site before it takes effect, and we will not apply it retrospectively to data already collected under the old terms without your consent.
The "last updated" date at the top always reflects the current version.
HighSpark is a brand of Arara Jewels LLP. Registered office: 209, 93 Avenue Mall, Solapur Road, Pune 411022, Maharashtra, India. GSTIN: 27ABVFA3915C1ZF.
Effective from: 17 August 2026
Last updated: 17 August 2026
