Our Commitment to Your Security
At OVIA, protecting your personal information is a fundamental part of providing a trustworthy shopping experience.
We are committed to responsible data handling, confidentiality, secure transactions, appropriate access controls, and transparency about how customer information is protected.
This page explains the standards we aim to maintain when processing information relating to customer accounts, orders, payments, shipping, returns, refunds, and customer communications.
Our security practices must be supported by appropriate technical and organizational safeguards. No digital service can guarantee absolute protection from every security risk.
01. Collection and Protection of Customer Data
OVIA collects and processes personal information only for specified, lawful business purposes and in accordance with its Privacy Policy.
Depending on the services used, such information may include:
- Customer names and contact information
- Billing and delivery addresses
- Account and authentication information
- Order history and transaction references
- Shipping and tracking information
- Return, exchange, cancellation and refund records
- Support requests, messages and relevant attachments
- Technical and security information
Our Standard: We seek to minimize unnecessary personal information, restrict its use to legitimate purposes, and protect it against unauthorized disclosure, alteration, misuse, or loss.
Information must not be collected solely because it may be useful for an unspecified future purpose.
02. Secure Account Authentication
OVIA supports customer authentication through available account access methods, which may include password-based sign-in, email verification codes, and supported third-party sign-in.
Authentication systems are designed to help prevent unauthorized account access.
Our Security Requirements Include:
- Appropriate protection of passwords
- Time-limited verification codes
- Restrictions on repeated verification attempts
- Secure session handling
- Access controls for protected account information
- Mechanisms for account recovery and security-related support
Customers must keep their passwords and verification codes confidential.
OVIA representatives will never request your password, UPI PIN, complete payment card security information, or active authentication code through ordinary support messages.
If you suspect unauthorized account activity, contact OVIA through its verified support channel.
03. Payment and Transaction Protection
Payments on OVIA may be facilitated by Razorpay or another authorized payment service provider.
Depending on the available payment options, customers may complete transactions through UPI, cards, net banking, or supported alternatives.
OVIA's Application Must Not Request or Store:
- UPI PINs
- Card verification values (CVV/CVC)
- Internet banking passwords
- Complete payment card credentials
- Confidential payment authentication codes
Sensitive payment information entered into an authorized provider's payment interface is handled according to that provider's applicable security standards and privacy policy.
OVIA may retain limited payment-related information such as transaction references, payment status, amounts, payment method categories and refund records.
A transaction should be treated as paid only after appropriate verification through trusted payment systems.
04. Customer Order and Delivery Information
When you place an order, OVIA processes the information needed to confirm the purchase, prepare the shipment, coordinate delivery and provide customer support.
Relevant details may be shared with Delhivery or another authorized logistics provider, including:
- Recipient name
- Delivery address
- Contact telephone number
- Shipment contents or descriptions where necessary
- Package information
- Tracking and shipment references
- Relevant delivery instructions
This sharing is limited to legitimate delivery and fulfillment requirements.
Courier partners may independently process necessary shipment information in accordance with their own applicable policies and legal obligations.
05. Returns, Exchanges and Refund Security
For eligible after-sales requests, OVIA may process order references, return reasons, delivery information, product photographs, transaction details and relevant support communications.
We seek to limit this processing to the information necessary to assess and resolve the request.
When photographs or supporting files are required, customers should avoid including unrelated personal information, identity documents, banking credentials, or confidential details.
Refund decisions and statuses must be based on authorized order and payment records.
OVIA will not request a customer's UPI PIN or card security code to issue an eligible refund.
06. Data Access and Confidentiality
Customer information must be accessible only to authorized persons or service providers with a legitimate need.
Access to customer data should be proportionate to the responsibilities being performed.
OVIA's Internal Data-Handling Rules Prohibit:
- Unauthorized viewing of customer records
- Disclosure of personal information for unrelated purposes
- Sharing account credentials with unauthorized persons
- Improper downloading or exporting of customer databases
- Use of customer information for personal purposes
- Unauthorized modification of orders or transaction records
- Disclosure of confidential information through public systems
Appropriate monitoring and access reviews should support these restrictions.
07. Administrative System Security
OVIA operates administrative functions for managing products, customers, orders, payments, inventory, fulfillment, returns, and support.
These systems require stronger access controls because they may process confidential customer and business information.
Administrative access must be limited to properly authorized individuals.
Administrative systems should use secure authentication, server-enforced permissions, protected credentials and appropriate security logging.
An administrative page being hidden from public navigation does not itself establish adequate security. Customer records must not become accessible merely through knowledge of an administrative URL.
08. Website and Infrastructure Protection
OVIA aims to maintain appropriate technical measures to reduce the risk of unauthorized access and system compromise.
Such measures may include:
- HTTPS/TLS protection for information in transit
- Secure database connections
- Restricted infrastructure permissions
- Server-side input validation
- Appropriate session and cookie protections
- Protection of API keys and application secrets
- Software updates and vulnerability remediation
- Security logging and monitoring
- Protected backups and recovery procedures
Security safeguards may evolve as OVIA introduces additional technologies or services.
09. Cookies and Session Security
OVIA may use necessary cookies to maintain customer sessions, support shopping functionality, remember permitted preferences, and protect account access.
Authentication cookies should be configured using appropriate security attributes and session-management practices.
Non-essential analytics or advertising technologies must be managed in accordance with applicable consent requirements.
For further information, please refer to OVIA's Cookie Policy and Cookie Preferences.
10. Third-Party Service Providers
OVIA relies on service providers for certain operational functions.
These may include payment processing, delivery services, cloud infrastructure, database hosting, email delivery, search and website performance.
We seek to work with service providers that offer safeguards appropriate to their role and the information they process.
Where required, contractual arrangements must address confidentiality, data protection responsibilities, security safeguards and incident cooperation.
Providing information to a service provider does not eliminate OVIA's applicable legal responsibilities.
11. Retention and Secure Deletion
OVIA retains information for legitimate business purposes and applicable legal obligations.
Different information categories may require different retention periods, including:
- Customer account records
- Payment and invoice records
- Order history
- Shipping information
- Return and refund records
- Customer support communications
- Technical and security logs
When information is no longer necessary and no applicable retention obligation requires its preservation, OVIA should delete or anonymize it using appropriate procedures.
Deletion requests may not result in the immediate removal of records that must be preserved for accounting, fraud prevention, legal compliance or dispute resolution.
12. Your Data Protection Rights
Customers may have rights under applicable law concerning their personal information.
These may include rights to:
- Request information about personal data processing
- Request correction of inaccurate information
- Request eligible erasure of personal data
- Withdraw consent where applicable
- Raise privacy-related grievances
- Exercise other rights provided by applicable law
Certain requests may require identity verification before processing. Request procedures, eligibility and applicable timelines are governed by relevant legal requirements.
OVIA will not intentionally disclose another customer's information in response to an unverified request.
13. Security Incident and Data Breach Response
OVIA treats suspected unauthorized access, disclosure, alteration, loss or misuse of personal information as a security concern.
When a potential incident is identified, appropriate steps may include:
- Investigating the reported incident.
- Restricting unauthorized access.
- Preserving relevant evidence.
- Assessing affected information and systems.
- Taking steps to contain and remediate the incident.
- Identifying measures to reduce the risk of recurrence.
- Providing notifications to affected individuals or authorities when legally required.
OVIA must not knowingly provide misleading information about a confirmed security incident. Notifications will be made according to the laws and obligations applicable at the time of the incident.
14. Customer Responsibilities
Customers can help protect their own accounts by:
- Using strong, unique passwords
- Keeping verification codes private
- Avoiding suspicious payment or login links
- Signing out on shared devices
- Checking the website address before entering sensitive information
- Reporting suspicious account activity promptly
- Avoiding unnecessary sensitive attachments in support requests
Customers should contact OVIA directly through verified website channels when uncertain about the authenticity of a communication.
15. Prohibited Activities
The following activities are prohibited when using OVIA's services without authorization:
- Attempting to access another customer's account
- Obtaining or disclosing another person's confidential information
- Circumventing authentication or access controls
- Interfering with website security or availability
- Attempting payment or refund fraud
- Uploading malicious files or code
- Misusing customer support features to harass or impersonate others
OVIA may take proportionate measures to restrict abusive activity, investigate incidents and comply with applicable law.
Nothing in this section is intended to prohibit lawful activities or invalidate mandatory consumer rights.
16. Legal and Regulatory Obligations
OVIA intends to comply with Indian data protection, cybersecurity and consumer protection requirements applicable to its activities.
These may include obligations arising under the Information Technology Act, 2000, applicable CERT-In directions, the Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025, according to their respective applicability and commencement provisions.
OVIA will review its policies and safeguards when relevant legal requirements or operational arrangements change.
17. Reporting a Security Concern
Customers can report suspected account compromise, phishing, unauthorized disclosure, suspicious payment requests or other security-related concerns through OVIA's official support channels.
Official Security & Grievance Contacts
- Website: https://www.ovias.shop
- Security & Privacy Contact: privacy@ovias.shop
- Customer Support: support@ovias.shop
- Grievance Contact: grievance@ovias.shop
Please include a description of the issue and relevant order reference, where appropriate. Do not include passwords, active OTPs, UPI PINs, card CVVs or other confidential payment credentials.
18. Changes to This Policy
OVIA may update this policy to reflect changes in its systems, services, security practices, or legal obligations.
The revised policy and updated effective date will be published on the website.
Where applicable law requires additional notice or consent, OVIA will follow those requirements.
Our Promise
Your trust is important to OVIA.
We aim to handle customer information carefully, limit unnecessary collection, maintain appropriate safeguards, and communicate transparently about privacy and security.
OVIA — Privacy, Security & Trust.