Rednom

Legal

Privacy Policy

Effective date: 22 April 2026

1. Who we are

This privacy policy describes how Rednom Innovations (“Rednom”, “we”, “our”), a company registered in India with its office in Kurnool, Andhra Pradesh, collects, uses, shares, and protects personal data in connection with our website (rednom.in), the consumer brands we operate (including CeSqua), and our use of the WhatsApp Business Platform provided by Meta Platforms, Inc. and its affiliates (“Meta”).

Rednom Innovations is the data fiduciary for personal data processed in connection with Rednom’s own website and platform operations. For each consumer brand we operate, the brand is the primary data fiduciary for its customer data, and Rednom acts as the technology provider processing data on the brand’s behalf.

2. Personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data:

  • Identity and contact data: name, email address, phone number (including the WhatsApp number on which you choose to receive messages).
  • Transaction data: orders placed with our brands, purchase history, order status, shipping and billing details (as required for fulfilment).
  • Messaging interaction data: content of WhatsApp messages you send or receive in a conversation with one of our brands, message delivery and read statuses, timestamps, and associated metadata.
  • Consent records: the channel through which you opted in to WhatsApp communications, the date of opt-in, and any subsequent changes to your consent.
  • Technical data: IP address, device type, operating system, browser type, referrer, and similar technical signals collected when you visit our websites.
  • Support data: information you choose to share when you contact support, make a data request, or report an issue.

3. Purposes for which we use personal data

  • Order and post-purchase communication: sending transactional notifications (order confirmation, shipment, delivery, returns, refunds) through WhatsApp, email, or SMS.
  • Customer support: responding to your questions, handling complaints, and improving our products and services.
  • Product guidance: where relevant to the brand (for example, skincare guidance for CeSqua customers), providing information about products you have purchased or asked about.
  • Marketing with consent: sending promotional WhatsApp messages only to users who have explicitly opted in, and only until they opt out.
  • Platform operations: operating our WhatsApp Business Platform integration as a Meta Tech Provider, including onboarding brand WhatsApp Business Accounts, managing message templates, and delivering messages.
  • Security and fraud prevention: detecting and preventing abuse, spam, and unauthorised access.
  • Legal and regulatory compliance: meeting our obligations under applicable law, including the Digital Personal Data Protection Act, 2023.

4. Legal basis

Under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), our primary legal basis for processing personal data is your explicit consent. You provide this consent at specific, clearly described points (for example, by ticking an opt-in box at checkout, or by sending a message that initiates a conversation with one of our brands).

Where applicable, we also rely on “certain legitimate uses” permitted under the DPDP Act, such as processing necessary to fulfil an order you have placed, respond to a request you have initiated, or comply with a legal obligation.

5. WhatsApp Business Platform

Rednom Innovations uses Meta’s WhatsApp Business Platform to send messages to customers of our consumer brands who have opted in to receive such communications. Message content, delivery status, and related metadata are processed by Meta in accordance with Meta’s own privacy policies and the WhatsApp Business Messaging Policy.

When a user interacts with one of our brands on WhatsApp, the following applies:

  • Messages are delivered through infrastructure operated by Meta and are subject to Meta’s WhatsApp Business Messaging Policy and WhatsApp’s privacy policy.
  • We send marketing messages only to users who have provided prior, explicit opt-in for the specific brand. Transactional and service notifications (such as order updates) are sent only when they relate to a transaction you have initiated.
  • We do not share your WhatsApp conversation content with third parties except as described in this policy (for example, our sub-processors who help us operate our platform) or as required by law.

6. How we share personal data

  • Meta Platforms, Inc. — as the operator of the WhatsApp Business Platform, to deliver messages you have consented to receive.
  • Infrastructure and tooling sub-processors — cloud hosting, database, email, logistics, payment, and analytics providers engaged to operate our services. We bind each sub-processor to confidentiality and data-protection obligations at least as protective as this policy.
  • Within Rednom’s brands — customer data collected by a specific brand remains under that brand’s ownership and is not used by other Rednom brands without a separate legal basis.
  • Legal, regulatory, and safety — where required by applicable law, court order, or to protect the rights, property, or safety of Rednom, our users, or others.
  • Corporate transactions — in connection with a merger, acquisition, or sale of assets, subject to customary confidentiality obligations and, where required, your consent.

We do not sell personal data.

7. Cross-border transfers

Some of our sub-processors, including Meta, may process personal data outside of India. Where we transfer personal data outside of India, we rely on the conditions permitted under the DPDP Act, including consent and contractual safeguards with the recipient.

8. Data retention

We retain personal data only for as long as is necessary for the purposes described in this policy:

  • Transactional data (orders, invoices, shipping records): up to 8 years after the transaction, as required for tax and accounting compliance in India.
  • WhatsApp conversation data and consent records: for the duration of the customer relationship and for up to 24 months after the last interaction, unless a longer retention is required by law, after which the data is deleted or anonymised.
  • Technical and analytics logs: up to 12 months from the date of collection.
  • Support tickets and correspondence: up to 36 months after resolution, to handle follow-up questions and disputes.

9. Security

We use reasonable administrative, technical, and physical safeguards to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include encryption in transit, access controls on production systems, logging and monitoring, least-privilege role assignment for personnel, and vendor due diligence. No system is perfectly secure; if we become aware of a personal data breach affecting you, we will notify you and the Data Protection Board of India as required by law.

10. Your rights

Subject to applicable law, you have the right to:

  • Access the personal data we hold about you.
  • Correct or update personal data that is inaccurate or incomplete.
  • Withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.
  • Request deletion of personal data we hold about you (see our Data Deletion Instructions).
  • Nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
  • Grievance redressal — raise a concern with our Grievance Officer (details below). If unresolved, you may escalate to the Data Protection Board of India.

11. WhatsApp opt-out

You can stop receiving WhatsApp messages from a Rednom-operated brand at any time by:

  • Replying STOP (or an equivalent clear opt-out phrase) to any WhatsApp message from that brand; or
  • Emailing rednomgroup@gmail.com with the subject line “WhatsApp Opt-Out” and the phone number you want unsubscribed.

Opt-out requests are processed promptly, typically within 2 business days. Transactional messages strictly required to complete an in-flight order (such as delivery notifications) may continue until that order is fulfilled.

12. Children

Our services are not directed at children under 18, and we do not knowingly collect personal data of children without parental consent. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

13. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you through the services you use.

14. Contact us

For any privacy-related question, request, or complaint, please contact our Grievance Officer:

Grievance Officer — Rednom Innovations
Email: rednomgroup@gmail.com
Address: Kurnool, Andhra Pradesh, India

Under the DPDP Act, you have the right to escalate an unresolved complaint to the Data Protection Board of India.

15. Policy references

This policy has been drafted with reference to the Digital Personal Data Protection Act, 2023 (India), the WhatsApp Business Messaging Policy, and Meta’s published developer policies for Tech Providers.