Privacy Policy

1. Introduction

Your privacy is important to us. We are sensitive to the fact that, in providing our services through arenasport.in, we may handle critical data and information — including personal data that you share to register, place orders, or otherwise use the Website.

By using this Website and providing your personal information, you consent to this Privacy Policy (“Policy”) and to our processing of your personal information for the purposes explained here. Your personal data will be processed on the basis of your consent under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), unless processing without consent is permitted under those laws. You may withdraw your consent at any time as set out in Section 13; such withdrawal will be effective only from the date we receive your request and will not affect the lawfulness of processing before that date.

We are the “Data Fiduciary” in relation to your personal data, and you are the “Data Principal”, as those terms are defined under the DPDP Act.

This Policy also reflects our obligations under:

• the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), to the extent applicable during the phased implementation of the DPDP Act;
• the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (“Intermediary Rules”); and
• the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020.

By registering on the Website or subscribing to any product or service and providing your contact details (telephone, email, mobile number, shipping address, etc.), you also acknowledge that this action constitutes consent, for the purposes of applicable telemarketing laws, to receive transaction-related and (where you have so opted) promotional communications from SIPL.

2. Scope

This Policy applies to all personal data processed by us in connection with the Website, our mobile interfaces, customer support, and order fulfilment activities. It does not apply to third-party websites or services that may be linked from the Website but are not controlled by us.

3. Our Privacy Commitment

We follow systematic and stringent procedures to protect the security of the information stored on our Website. Information you share is stored on secure servers with encryption and can be accessed only for authorised official purposes. Any of our employees who violates our privacy or security policies relating to consumer data is subject to disciplinary action, including possible termination and civil or criminal action where appropriate.

4. Registration on the Website

To sign up on the Website, you are required to provide your mobile number for the generation of a One-Time Password (“OTP”) via SMS. Upon logging in through the OTP, you will be asked to provide certain basic mandatory information, including your name and email ID. Once registration is complete, your registered mobile number can be used to access your account each time you visit the Website.

5. Information We Collect

We collect information that is either anonymous or personally identifiable. We collect only such personal data as is necessary for the specific purposes described in this Policy.

a. Information you give us

We receive and store any information you enter on the Website or provide to us in any other way, including:

• Name, gender, date of birth (optional), email ID, telephone and mobile number;
• Billing and shipping addresses, alternate contact number, delivery instructions;
• Physical characteristics relevant to product fit (e.g., size preferences) where you choose to provide them;
• Reviews, ratings, feedback, and queries you submit through the Website, email, or customer care;
• KYC / verification data where required by law (e.g., for high-value transactions): government-issued ID details.

You may choose not to provide certain information, but in such case some Website features and services may not be available to you. Mandatory information must be filled in to place an order with us.

b. Automatic information

We receive and store certain types of information whenever you interact with us. Like many websites, we use “cookies” (see Section 7) and obtain certain information when your web browser accesses arenasport.in. This includes:

• Device and connection information (IP address, browser type, device identifiers, operating system);
• Usage information (pages viewed, search terms entered, products viewed, items added to cart, session timestamps);
• Referral website or source of origin;
• Aggregated demographic and geographic information used to improve security, analyse trends, and administer the Website.

c. Email communications

Registration on the Website entitles us to send you transactional emails (order confirmations, shipping updates, returns, account-related notices). Subscriptions to our newsletters or marketing programmes entitle us to send you periodic promotional emails. If you do not wish to receive promotional emails, you may unsubscribe by clicking the “unsubscribe” link at the footer of any such email, or by writing to us at [Insert customer-care email].

d. SMS communications

Upon placing an order on the Website, we are entitled to use your registered mobile number to send transaction-related SMS to you in connection with that order, irrespective of “DND” (Do Not Disturb) services activated on your mobile, as permitted under applicable TRAI regulations. You hereby authorise us to send such transactional SMS to your registered number. We may occasionally send promotional SMS to your registered mobile number where you have opted in to such communications; you may opt out at any time by replying as instructed in the SMS or by writing to our customer care.

e. Payment information

We do not collect credit-card, debit-card, or net-banking details on our own servers. On clicking “Pay Now”, you will be redirected to a secure payment gateway or your bank’s net-banking page to complete the transaction. You will then enter your card details or net-banking credentials on that page. On successful completion, you will be redirected to our Website with your order details and order number displayed.

We will not store any bank-related credentials on our records and none of our staff will hold or be exposed to such information. We may retain limited non-sensitive transaction metadata (e.g., card type, last four digits, UPI handle, transaction ID) provided to us by the payment gateway, for the purposes of reconciliation, refunds, and fraud prevention.

f. Information from other sources

We may also receive relevant information from third parties such as:

• our payment gateway and acquiring bank (payment confirmation and fraud-screening signals);
• our logistics and courier partners (shipping status updates);
• third-party login providers where you choose to sign in using such a service (e.g., the basic profile information that service shares with us).

We do not knowingly collect special category data such as biometric, health, caste, religious, or political information through the Website.

6. Server Logs

To ensure easy and reliable use of the Website, our servers automatically collect certain statistical information each time you visit, including the type of pages viewed. This information is used in aggregate to understand how our Website is being used and does not, by itself, identify you personally.

7. Cookies and Similar Technologies

Accepting cookies is not mandatory for using your account. However, cookies enable a quicker and improved shopping experience, including signing in less frequently during a session. Cookies are small files that identify your computer or device to our server as a unique user when you visit pages on our Website.

We use the following categories of cookies:

• Strictly necessary cookies — enable core functions such as logging in, maintaining your shopping cart, and processing checkout. These cannot be disabled without breaking the Website.
• Preference cookies — remember language, currency, and similar choices.

You may configure your browser to prevent cookies from being set on your device. If you reject or delete cookies, you may still use the Website, but your ability to use some areas or features may be limited.

We do not currently use third-party advertising, behavioural-tracking, or cross-site profiling cookies on the Website. If this changes in future, we will update this Policy and obtain your consent through a cookie banner before placing any such cookies.

8. Purposes for Which We Process Your Data

We process your personal data only for the following specified purposes:

• To create and manage your user account on arenasport.in;
• To process, fulfil, ship, and deliver your orders for arena® swimwear, sports gear, and merchandise;
• To process payments, issue tax invoices, and handle refunds, returns, and exchanges;
• To communicate with you about your orders, account, customer-support queries, and service updates;
• To prevent fraud, unauthorised transactions, abuse, and to investigate security incidents;
• To comply with applicable laws — including tax, GST, accounting, consumer-protection, and data-protection laws — and to respond to lawful requests from authorities;
• To improve the Website’s functionality, performance, content, design, and user experience, using aggregated or de-identified data wherever possible;
• To send transactional communications (order confirmations, shipping alerts, returns); promotional and marketing communications will be sent only with your separate consent and you may opt out at any time.

We will not process your personal data for any purpose other than those listed above without first obtaining your fresh consent or otherwise relying on a lawful ground under the DPDP Act.

9. Legal Basis for Processing

We process your personal data on the following bases under the DPDP Act:

• Your consent, given freely, specifically, and after being informed by the notice presented to you at the time of collection; and
• Certain “legitimate uses” permitted under Section 7 of the DPDP Act, including where you have voluntarily provided your data for a purpose and have not indicated that you do not consent to such use, and where processing is necessary to comply with law or a court order.

10. Users Under the Age of 18

The Website is intended for users who are 18 years of age or older. We do not knowingly collect, maintain, or use personal information of children under the age of 18, and we do not sell products or services directly to children. Purchases of children’s products on the Website are intended to be made by a parent or lawful guardian using their own adult account.

Children should seek the consent of their parents or lawful guardians before providing any information about themselves or their family members online.

In relation to any personal data of children that may inadvertently be processed by us, we commit that we will not:

• undertake tracking or behavioural monitoring of children;
• direct targeted advertising at children; or
• process children’s data in any manner likely to cause a detrimental effect on the well-being of the child.

If a parent or lawful guardian believes that a child has provided personal data to us, they may contact our Grievance Officer (Section 17) and we will delete the data without undue delay, except where retention is required by law.

11. With Whom We Share Your Personal Data

We do not sell your personal data. We disclose your personal data to external parties only in accordance with the DPDP Act and other applicable privacy laws, and only to the extent necessary. The categories of recipients include:

• Affiliates and group entities, including arena S.p.A., Italy, and other arena affiliates, for product authentication, after-sales support, warranty, and group-level reporting (subject to confidentiality and the cross-border safeguards in Section 12);
• Payment service providers and banks, to process your payments and refunds;
• Logistics and courier partners, to deliver your orders;
• Cloud-hosting and IT service providers, under contractual obligations of confidentiality and security;
• Customer-support and communication providers (e.g., email, SMS, WhatsApp business messaging providers) for transactional communications;
• Professional advisors such as chartered accountants, auditors, and lawyers, under confidentiality obligations;
• Government, regulatory, judicial, or law-enforcement authorities, where required by law, court order, or in response to a lawful request, including under Rule 23 of the DPDP Rules;
• Successors-in-interest in the event of a merger, acquisition, restructuring, or sale of all or part of our business, subject to confidentiality safeguards.

Each recipient acting on our instructions is a “Data Processor” under the DPDP Act and is bound by a written contract to process your data only for the purpose for which it was shared and to retain it only for the period we specify.

12. Cross-Border Transfers

As SIPL is the Indian distributor of arena S.p.A., Italy, certain limited personal data may be transferred to arena S.p.A. and other arena group entities outside India for the purposes set out in Section 11. Such transfers will be limited to jurisdictions that are not restricted by the Central Government from time to time under Section 16 of the DPDP Act, and will be subject to contractual safeguards designed to protect your personal data.

For payment-related data, we additionally comply with the Reserve Bank of India’s directions on storage of payment system data, including storage of payment data on systems located in India.

13. Data Retention

We keep your personal information only for as long as it is necessary for the purposes set out in this Policy, unless a longer retention period is required or permitted by law (such as tax, GST, accounting, or other legal requirements).

When we have no ongoing legitimate business need to process your personal information, we will either delete it or irreversibly anonymise it; if this is not immediately possible (e.g., where the data is stored in backup archives), we will securely store and isolate it from further processing until deletion is possible.

14. Your Rights as a Data Principal

Under the DPDP Act, you have the following rights:

• Right to access — you may request a summary of the personal data we process about you and the processing activities we undertake.
• Right to rectification — if you believe that data we hold about you is not up to date, accurate, or complete, you may contact us for correction. We will investigate and resolve the matter within 15 business days from receipt of your request.
• Right to erasure / restriction of processing — you may request us to erase or restrict processing of your personal data, subject to applicable conditions. Exercising this right may impact your access to some of our services.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time by contacting our customer care or Grievance Officer.
• Right to nominate — you may nominate another individual who shall, in the event of your death or incapacity, exercise your rights under the DPDP Act.
• Right to grievance redressal — you may register a grievance with our Grievance Officer (Section 17). If you are not satisfied with the response, or do not receive a response within the prescribed time, you may register a complaint with the Data Protection Board of India.

15. Data Security

We have in place appropriate technical and organisational measures to prevent unauthorised or unlawful access to, or accidental loss, destruction, or damage of, your information. These include:

• encryption of data in transit (TLS) and of sensitive data at rest;
• access controls and role-based permissions for our personnel;
• secure password / OTP-based authentication;
• periodic security reviews and vulnerability assessments;
• tokenisation of payment instrument data through PCI-DSS compliant payment partners;
• contractual security obligations on our processors.

Though we are unable to guarantee 100% security, encryption makes it significantly harder for a malicious actor to decrypt your details. In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals in accordance with the timelines and manner set out in the DPDP Rules.

You are strongly advised not to send full credit-card or debit-card details in unencrypted electronic communications. Except on the payment gateway or your bank’s page, you should not submit or send your bank credentials to the Website, to any email IDs, or to any other IDs.

16. Safety and Security Tips for Users

A. Do not disclose your OTP

• Keep your OTP private. Anyone who knows your OTP can access your account.
• Always log out at the end of your online session instead of just closing the browser.

B. Protect your device

• Fraudsters may send genuine-looking emails containing viruses that install malicious code on your device and extract confidential information.
• Keep your device updated with the latest anti-virus / anti-spyware software.
• Install a personal firewall on your device.
• Do not click on links or open attachments in unknown or unsolicited (spam) emails.

17. Grievance Officer and Resident Nodal Officer

We address consumer complaints and grievances regarding any products or services offered on the Website in a time-bound manner. For this purpose:

Grievance Officer (under Section 8(10) of the DPDP Act and Rule 3(2) of the Intermediary Rules)

We will acknowledge your complaint within 48 hours and endeavour to resolve it within the time limits prescribed under applicable law.

Resident Nodal Officer (under the Consumer Protection (E-Commerce) Rules, 2020)

In accordance with the Consumer Protection (E-Commerce) Rules, 2020, we have appointed a resident Nodal Officer who is responsible for ensuring compliance with the Consumer Protection Act, 2019 and the rules made thereunder. In the event of an escalation — where the Grievance Officer is unable to resolve a complaint within the timeline communicated — you may contact the Nodal Officer:

18. Changes to This Policy

SIPL may, at its discretion, update this Policy from time to time to reflect changes in law, our services, or our practices. The “Last Updated” date at the top will indicate when the Policy was last revised. We encourage you to review this Policy whenever you visit the Website. Material changes will be communicated to you via email or a prominent notice on the Website, and, where required by law, your fresh consent will be sought. Unless stated otherwise, the current Policy applies to all information that we hold about you and your account.

19. Governing Law and Jurisdiction

If you choose to visit this Website, your visit, and any dispute over privacy, are subject to this Policy and our Terms of Use, including any limitations on damages, resolution of disputes, and the application of the laws of India. Subject to the jurisdiction of the Data Protection Board of India and the appellate forums under the DPDP Act, the courts at Mumbai, Maharashtra shall have exclusive jurisdiction over any dispute arising out of or in connection with this Policy.