Privacy Policy

Effective 2 July 2026 · Last updated 2 July 2026

This Privacy Policy explains how Ellan Style, trading as Éllan ("Éllan", "we", "us"), collects, uses, shares and protects your personal data when you visit https://ellan.in (the "Website"), place an order, or communicate with us. We are the data fiduciary for this data under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025, and we also comply with the Information Technology Act, 2000 and the Consumer Protection (E-Commerce) Rules, 2020.

By using the Website, or by providing your details at checkout or sign-up, you consent to the practices described here. Consent on this Website is always taken through clear, affirmative action — we do not use pre-ticked boxes.

1. What personal data we collect

  • Identity & contact data — your name, email address, phone number, and billing and shipping addresses.
  • Order & transaction data — the items you buy, order value, order history, delivery status, and exchange or refund requests.
  • Payment data — processed entirely by our payment partners over secure, PCI-DSS-compliant systems. We never see, collect or store your card number, UPI PIN, CVV or banking credentials. Card details, where saved, are tokenised by the payment network as per RBI rules.
  • Communications — messages you send us by email, contact form, Instagram or WhatsApp, and our replies.
  • Marketing preferences — whether you have opted in to updates, and your consent status.
  • Technical & usage data — device type, browser, IP address, pages viewed and interactions, collected through cookies and similar technologies.

2. Why we collect it (purposes)

  • To accept, process, ship and deliver your orders, and to send order and delivery updates by email, SMS or WhatsApp.
  • To handle cancellations, exchanges, store credits, refunds and customer-support requests.
  • To verify orders and prevent fraud, payment abuse and misuse of the Website.
  • To send you updates about new Éditions and Éllan news — only if you opt in; you can unsubscribe at any time.
  • To understand how the Website is used and improve our products, pages and service.
  • To meet our legal obligations — tax, accounting, consumer protection and record-keeping.

We collect only what is needed for these purposes, and we do not use your data for any purpose that is incompatible with them without asking you first.

3. Who we share it with

We do not sell or rent your personal data. We share it only with service providers ("data processors") who need it to serve you, under contracts that restrict their use of it:

  • Platform — Shopify Inc., which hosts the Website and stores order data on secure infrastructure.
  • Payments & checkout — our checkout and payment partners (including GoKwik and its associated payment gateways), for processing payments, COD verification and fraud prevention.
  • Logistics — courier and logistics partners, who receive your name, address and phone number to deliver orders and manage reverse pickups.
  • Returns — our returns-management partner (Return Prime), for processing exchange and refund requests.
  • Analytics & advertising — analytics and advertising tools (such as Shopify analytics, Meta and Google), to measure the Website and our campaigns.
  • Authorities — where required by law, court order, or to protect our legal rights.

Some of these providers process data on secure servers located outside India; where they do, the transfer is made as permitted under the DPDP Act and applicable law.

4. Cookies

  • Essential cookies — required for the cart, checkout and security. The Website cannot function without them.
  • Analytics cookies — help us understand which pages are used and how the store performs.
  • Advertising cookies — measure our campaigns and, where applicable, show you relevant ads.

You can control or delete cookies through your browser settings. Disabling essential cookies may prevent checkout from working.

5. How long we keep it

  • Order and invoice records — retained as required under GST, tax and accounting law.
  • Support correspondence — retained for as long as needed to resolve the matter and for a reasonable period after.
  • Marketing data — retained until you unsubscribe or ask us to delete it, after which it is removed from active use.

When personal data is no longer required for its purpose or by law, we delete it or anonymise it.

6. How we protect it

The Website runs on Shopify's secure infrastructure with encrypted (HTTPS/TLS) connections. Access to personal data is restricted to those who need it to serve you. Payment processing is PCI-DSS compliant through our payment partners. In the event of a personal data breach that affects you, we will inform you and the Data Protection Board of India as required under the DPDP Act and its Rules, including a plain-language description of what happened, what data was involved, and the steps you can take.

7. Your rights

Under the DPDP Act, you have the right to:

  • Access — request a summary of the personal data we hold about you and how it is used.
  • Correction & completion — have inaccurate or incomplete data corrected or updated.
  • Erasure — request deletion of your personal data, subject to legal retention requirements.
  • Withdraw consent — withdraw any consent you have given, at any time, as easily as you gave it. Withdrawal does not affect processing already carried out.
  • Nominate — nominate another individual to exercise your rights in the event of death or incapacity.
  • Grievance redressal — raise a complaint about how your data is handled.

To exercise any of these rights, write to us via the details on our Contact Us page. We acknowledge requests within 48 hours and aim to resolve them within one month. If you are not satisfied with our response, you may approach the Data Protection Board of India.

8. Children

The Website is intended for users aged 18 and above. We do not knowingly collect personal data from children, and we do not track, monitor or behaviourally target children in any form.

9. Third-party links

The Website may link to third-party sites (for example Instagram). Their privacy practices are their own; this policy does not cover them.

10. Grievance officer

Our grievance officer's name and contact details are published on the Contact Us page, in accordance with the Consumer Protection (E-Commerce) Rules, 2020 and the Information Technology Act, 2000. Complaints are acknowledged within 48 hours and resolved within one month of receipt.

11. Changes to this policy

We may update this policy from time to time — for example, as the DPDP Rules come into full force. The current version, with its effective date, will always be published on this page. Material changes will be highlighted on the Website or notified to you where required.