Privacy Policy – Origin to eXXcel

1. Introduction and Scope

This Privacy Policy explains how OTOXX SPORTS & ENTERTAINMENT LLP (“Company,” “we,” “us,” “our”) collects, uses, discloses, and protects personal data of visitors and customers (“you”) of [www.otoxx.com] and related mobile applications (the “Platform”). This Policy is issued in compliance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000, and applicable rules made thereunder.

By using the Platform, you agree to the collection and use of information as described in this Policy. If you do not agree, please discontinue use of the Platform.

2. Data Fiduciary Details

Data Fiduciary	OTOXX SPORTS & ENTERTAINMENT LLP
Registered Address	PLOT NO. EL87, SECOND FLOOR, TTC INDUSTRIAL AREA, MIDC MAHAPE, NAVI MUMBAI-400 710, India]
CIN/GSTIN	GSTIN -27AAKFO2444E1ZC
Contact Email	info@otoxx.com

3. Personal Data We Collect

3.1 Account & Order Data: name, email address, phone number, delivery/billing address, order history, and (for business accounts) PAN/GST details.

3.2 Payment Data: payment method type and transaction status; full card/UPI credentials are collected and tokenized directly by our PCI-DSS compliant payment partners and are not stored on our servers.

3.3 Custom/Personalization Data: photographs, images, or artwork you upload to create Custom Products (e.g., personalized posters), which may include images of you or third parties.

3.4 Communications Data: records of customer support conversations (email, chat, WhatsApp, phone) and any content/attachments you share with us, including for authenticity or redemption claims.

3.5 Device & Usage Data: IP address, browser type, device identifiers, pages viewed, referring URLs, and approximate location, collected via cookies and similar technologies (see Section 8).

3.6 Marketing Preferences: your opt-in/opt-out status for promotional emails, SMS, and WhatsApp messages, and your engagement with such communications.

3.7 Loyalty/Rewards Data: points balance, referral activity, and redemption history, where you participate in our loyalty/rewards program.

3.8 Sensitive Personal Data: we do not intentionally collect sensitive categories of personal data (e.g., health, biometric, or religious data) unless voluntarily provided by you (for example, in a customer support query), in which case it is handled with additional care and only for the purpose you provided it.

4. How We Use Personal Data

We process personal data for the following purposes, consistent with the notice-and-consent framework of the DPDP Act:

processing and fulfilling your orders, including shipping, customs documentation (for imported products), and payment processing;
printing and producing Custom Products from your uploaded designs;
providing customer support, handling authenticity/redemption/return claims;
verifying your identity for Cash on Delivery orders and preventing fraud;
sending transactional communications (order confirmations, shipping updates, OTPs);
sending promotional communications where you have opted in, and administering the loyalty/rewards and affiliate programs;
improving the Platform through analytics, and (where consented) interest-based advertising;
complying with applicable law, including tax, accounting, and consumer protection obligations; and
responding to grievances, legal process, or requests from regulatory/law enforcement authorities.

5. Consent and Legal Basis

5.1 We rely on your consent as the primary basis for processing personal data under the DPDP Act, obtained through clear affirmative action (e.g., checking a box, submitting a form, or continuing to use the Platform after notice, as applicable). Where processing is necessary for performing our contract with you (e.g., fulfilling an order) or for compliance with law, we rely on those permitted grounds as recognized under the DPDP Act.

5.2 You may withdraw consent at any time for purposes that are not otherwise legally required, without affecting the lawfulness of processing carried out before withdrawal. Withdrawing consent for certain processing (e.g., delivery address) may affect our ability to fulfil your order.

5.3 This Policy, together with the specific consent request presented to you at the point personal data is collected, constitutes the notice required under Section 5 of the DPDP Act — informing you of the personal data being collected, the purpose of processing, how to exercise your rights under Section 11, and how to lodge a complaint with our Grievance Officer or the Data Protection Board of India.

5.4 You may also give, manage, review, or withdraw your consent through a Consent Manager registered with the Data Protection Board of India, once the Consent Manager registration framework becomes operational (registration under the DPDP Rules, 2025 opens in November 2026).

6. Sharing and Disclosure of Personal Data

We may share personal data with the following categories of recipients, strictly for the purposes described in this Policy:

Courier and logistics partners, to deliver your orders;
Payment gateways and financing/BNPL partners, to process payments and installment plans;
Cloud hosting and IT service providers, for secure storage and Platform operation;
Printing and fulfilment vendors, for Custom Products;
WhatsApp Business API, SMS gateway, and email service providers, to send order and marketing communications;
Analytics and advertising platforms, on an aggregated or pseudonymized basis where possible, and only for interest-based advertising if you have consented;
Affiliate/referral partners, limited to information needed to attribute and pay referral commissions;
Manufacturers/licensors, where necessary to process redemption card claims;
Government authorities, regulators, or courts, where required by law, or to establish, exercise, or defend legal claims; and
A successor entity, in the event of a merger, acquisition, or sale of business assets.

We do not sell personal data to third parties for monetary consideration. Unlike certain other jurisdictions, Indian law does not currently prescribe a “Do Not Sell My Data” mechanism; however, you may still object to non-essential processing (e.g., interest-based advertising) as described in Section 8 and exercise your rights under Section 11.

7. Data Storage, Retention, and Cross-Border Transfer

7.1 Personal data is primarily stored on servers located in [India / specify region], operated by our cloud hosting providers.

7.2 We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, comply with our legal obligations (e.g., tax and accounting records under Indian law), resolve disputes, and enforce our agreements, after which it is securely deleted or anonymized.

7.3 Where personal data is transferred outside India (e.g., to a cloud provider or manufacturer/licensor located abroad), such transfer will be carried out in accordance with the DPDP Act, including any list of restricted countries/territories notified by the Central Government from time to time.

8. Cookies and Tracking Technologies

8.1 We use cookies, pixels, and similar technologies for: (a) essential functioning of the Platform (e.g., cart, login sessions); (b) analytics to understand Platform usage; and (c) where you consent via our cookie banner, interest-based advertising to show you relevant ads on and off the Platform.

8.2 You can manage or withdraw cookie consent at any time through our cookie preference tool (where available) or your browser settings. Disabling non-essential cookies may affect certain Platform features but will not prevent you from placing orders.

8.3 We may use third-party advertising and analytics providers (e.g., Google, Meta) who may set their own cookies subject to their respective privacy policies.

9. Data Security

9.1 We implement reasonable security practices and procedures, including encryption in transit (HTTPS/TLS), access controls, and tokenized payment processing, consistent with the requirements of the IT Act, 2000 and applicable rules.

9.2 No method of transmission or storage is 100% secure; while we strive to protect your personal data, we cannot guarantee absolute security.

10. Children’s Data

10.1 The Platform is not directed at children under 18. We do not knowingly collect personal data from children without verifiable parental/guardian consent, as required under Section 9 of the DPDP Act.

10.2 If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete such data promptly.

10.3 We do not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children, except where such processing is permitted for a class of Data Fiduciaries or purposes exempted by the Central Government under the DPDP Act (e.g., certain health, safety, or educational contexts).

11. Your Rights

Subject to the DPDP Act and its rules, you have the right to:

access a summary of the personal data we hold about you and the processing activities undertaken;
request correction, completion, or updating of your personal data;
request erasure of your personal data, unless retention is required for a legal purpose;
withdraw consent at any time (see Section 5.2);
nominate another individual to exercise your rights in the event of death or incapacity, as permitted under Section 14 of the DPDP Act; and
file a complaint with our Grievance Officer (Section 14) and, if unresolved, with the Data Protection Board of India.

To exercise these rights, please contact us using the details in Section 14. We may need to verify your identity before processing your request, and may take up to [30 days] to respond.

12. Marketing Communications and Opt-Out

12.1 Promotional emails, SMS, and WhatsApp messages are sent only where you have opted in. You can opt out at any time via the “unsubscribe” link, your account settings, or by writing to [support email].

12.2 We honour registrations on the National Customer Preference Register (NCPR)/Do Not Disturb (DND) registry in accordance with the Telecom Commercial Communications Customer Preference Regulations (TCCCPR) issued by TRAI, and will not send promotional communications to numbers registered there, except transactional messages necessary for order fulfilment.

13. Data Breach Notification

In the event of a personal data breach that is likely to affect you, we will, without delay, intimate the Data Protection Board of India and affected individuals, and will submit a detailed report to the Board within 72 hours of becoming aware of the breach (or such extended period as the Board may permit), describing the nature, extent, timing, and likely impact of the breach and the steps being taken to mitigate harm and prevent recurrence.

14. Grievance Officer / Data Protection Contact

Grievance Officer	Satbir Singh Khokhar
Designation	Marketing Manager
Email	info@otoxx.com
Address	PLOT NO. EL87, SECOND FLOOR, TTC INDUSTRIAL AREA, MIDC MAHAPE, NAVI MUMBAI-400 710 . India
Response Timeline	Acknowledgement within 48 hours (as required for intermediary grievances under the IT Rules, 2021) and resolution within 30 days as our internal service standard, which is well within the maximum 90-day period allowed under the DPDP Rules, 2025.

15. Third-Party Links

The Platform may contain links to third-party websites or services (e.g., payment gateways, social media, financing partners). We are not responsible for the privacy practices of such third parties, and we encourage you to review their respective privacy policies.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via the Platform or by email at least [7 days] before becoming effective. The “Last Updated” date at the top of this Policy indicates when it was last revised.

17. Contact Us

For any questions about this Privacy Policy or our data practices, please contact us at info@otoxx.com / [phone number- +91 9594031555] / OTOXX SPORTS & ENTERTAINMENT LLP ,PLOT NO. EL87, SECOND FLOOR, TTC INDUSTRIAL AREA, MIDC MAHAPE, NAVI MUMBAI-400 710 .