1. Who we are
This policy explains how XLVERO IT PRIVATE LIMITED (“XLVERO”, “we”, “us”) handles personal data collected through this website. We are the data fiduciary for that data under the Digital Personal Data Protection Act, 2023, and we also follow the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
- Registered entity
- XLVERO IT PRIVATE LIMITED, a private limited company
- Registered office
- WA-13, WZ-11, Vill Asalatpur, Janak Puri, Shop at Ground Floor out of Property No. 13, New Delhi, Delhi - 110058
- GSTIN
- 07AAACX6244Q1ZQ
- CIN
- Not applicable
- Contact
-
support@xlvero.com
8796135189 - Line of business
- Retail of men's and boys' clothing
2. What we collect
We collect the minimum needed to sell you a product and get it to your door.
| Category | What it includes |
|---|---|
| Order details | Name, delivery address, PIN code, mobile number and email address |
| Transaction records | Order reference, items ordered, amount, payment method and the gateway’s transaction reference |
| Communications | Messages you send us through the contact form, email or WhatsApp, and our replies |
| Technical data | IP address, browser and device type, and pages viewed, collected through server logs and analytics |
We do not collect or store UPI IDs, UPI PINs, OTPs, card numbers, CVV codes or net-banking credentials at any point.
Kept on your device, not ours
Your shopping bag and any delivery details you choose to save from the account page are stored in your own browser. They are never transmitted to us until you place an order, and clearing your browser data deletes them.
3. Why we use it
- To fulfil your order — process payment, raise a GST invoice, pack, ship and deliver, and handle returns and refunds.
- To communicate about your order — confirmations, dispatch and tracking updates, and answers to what you ask us.
- To meet legal obligations — tax and GST records, and responses to lawful requests from an authority.
- To improve the website — aggregated, non-identifying analysis of how the catalogue is used.
- To send you marketing — only if you subscribed, and only until you unsubscribe.
Placing an order is your consent to the processing needed to fulfil it. Marketing consent is separate and can be withdrawn at any time without affecting your orders.
4. Payments
UPI payments are processed end to end by our payment gateway partner, MMADPay. You are taken to a secure payment surface and your payment credentials are entered there, not here. We receive back only the transaction status, amount and reference number, which we store to reconcile the order and to process any refund. Cash-on-delivery orders involve no payment data at all.
5. Who we share it with
We do not sell, rent or trade personal data. We share it only with the parties needed to complete the sale:
- Courier and logistics partners — your name, delivery address and mobile number, so the parcel reaches you.
- Payment gateway — the amount, order reference and the contact details required to raise the transaction.
- Email and hosting providers — who process data on our instructions under confidentiality obligations.
- Authorities — where disclosure is required by law, a court order or a valid enforcement request.
6. Cookies & analytics
We use a small number of cookies and equivalent browser storage. Strictly necessary items keep your session and shopping bag working and cannot be switched off without breaking checkout. Analytics cookies, where enabled, tell us which pages are used and are configured to avoid identifying you personally. You can block or delete cookies in your browser settings; checkout will stop working if you block the necessary ones.
7. How long we keep it
| Data | Retention |
|---|---|
| Order and invoice records | 8 years, as required by Indian tax law |
| Contact form messages | 24 months from the last reply |
| Marketing subscription | Until you unsubscribe |
| Server and analytics logs | 12 months |
8. Security
The site is served over HTTPS/TLS. Access to order data is limited to the people who need it to fulfil and support orders, and administrative access is password-protected. No system is perfectly secure, so we also commit to telling you and the relevant authority promptly if a breach affects your personal data.
9. Your rights
Under the DPDP Act, 2023 you may ask us to:
- confirm what personal data of yours we hold, and give you a copy of it;
- correct anything inaccurate, incomplete or out of date;
- erase data we no longer need for a legal or contractual purpose;
- withdraw a consent you previously gave, including for marketing;
- nominate someone to exercise these rights on your behalf if you are unable to.
Write to grievance@xlvero.com from the email address on the order. We respond within 30 days. Records we are legally required to retain, such as tax invoices, cannot be erased before their retention period ends.
10. Children
This website is not directed at children and we do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.
11. Changes & contact
We may update this policy as the law or our operations change. The revised version is posted here with a new date, and material changes are notified by email to anyone on our list. Continuing to use the website after a change means you accept the updated policy.
For any question about this policy, or to exercise a right above, contact Sanchit Rajput, our grievance officer, at grievance@xlvero.com, or see the grievance redressal page.
Last updated July 2026