Privacy Policy

PARKSONS CARTAMUNDI PRIVATE LIMITED (hereinafter referred to as "the Company," "We," "Us," or "Our"), a company incorporated under the Companies Act, 1956, and engaged in the manufacture, marketing, and sale of card games and allied products in India, is committed to safeguarding the privacy and personal data of every individual (hereinafter referred to as "User," "You," or "Your") who accesses, browses, or transacts through our website www.parksonscartamundi.com (hereinafter referred to as "the Website").

This Privacy Policy ("Policy") is published and governed in accordance with the following applicable laws and regulations of India:

• The Information Technology Act, 2000 ("IT Act"), as amended;
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), framed under Section 43A of the IT Act;
• The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("Intermediary Guidelines");
• The Digital Personal Data Protection Act, 2023 ("DPDP Act"), and any rules notified thereunder (to the extent applicable upon commencement);
• The Consumer Protection Act, 2019, and the Consumer Protection (E-Commerce) Rules, 2020;
• Any other applicable statutory provisions, guidelines, or orders issued by competent authorities from time to time.

By accessing or using the Website, You expressly consent to the collection, storage, use, and disclosure of Your personal information in accordance with this Policy. If you do not agree with any part of this policy, you are requested to immediately discontinue use of the website.

• Unless the context otherwise requires, the following terms shall have the meanings ascribed to them hereunder:
• "Personal Data / Personal Information" means any information that relates to a natural person and which, either directly or indirectly, in combination with other information available or likely to be available with the Company, is capable of identifying such a person. This includes, inter alia, name, address, email address, phone number, date of birth, financial information, and device identifiers.
• "Sensitive Personal Data or Information" ("SPDI") has the meaning ascribed to it under Rule 3 of the SPDI Rules, 2011, and includes passwords, financial information (bank account, credit card, debit card, or other payment instrument details), physical, physiological, and mental health conditions, sexual orientation, medical records and history, and biometric information.
• "Data Principal" means the individual to whom the personal data relates, as defined under the DPDP Act, 2023.
• "Data Fiduciary" means the company, which alone or in conjunction with others determines the purpose and means of processing of personal data.
• "Data Processor" means any person who processes personal data on behalf of the company.
• "Consent" means any freely given, specific, informed, and unambiguous indication of the Data Principal's wishes by which they, by a clear affirmative action, signify agreement to the processing of Personal Data relating to them.
• "Processing" means any operation or set of operations performed on personal data or sets thereof, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.
• "Website" means www.parksonscartamundi.com, including all sub-domains, associated applications, and digital platforms operated by the company.
• "Cookies" means small text files placed on the user's device by the website to enable certain functionalities and enhance the user experience.
• "Third Party" means any person or entity other than the User and the Company.

This policy applies to all personal data collected by the company through:

• Voluntary registration or account creation on the website;
• Placing orders for card games, merchandise, or other products;
• Subscriptions to newsletters, promotional communications, or loyalty programs;
• Participation in contests, game tournaments, surveys, or feedback mechanisms;
• Communication with the company via email, telephone, chat, or social media;
• Automatic collection through cookies, log files, and tracking technologies upon visiting the website.

This policy does not apply to third-party websites linked to or from the website. The company is not responsible for the privacy practices of such third-party websites.

Information Provided Voluntarily by You

When you register on or interact with the website, we may collect the following categories of personal data:

• Identity Information: Full name, username or display name, gender, and date of birth;
• Contact Information: Postal address, email address, and mobile or telephone number;
• Account Credentials: Password and security questions (stored in encrypted form);
• Financial Information: Payment card details, UPI ID, bank account number, billing address, and transaction history (processed via PCI-DSS compliant payment gateways);
• Order Information: Details of products purchased, delivery preferences, and order history;
• Communication Data: Correspondence with our customer support team, survey responses, and feedback submitted;
• Professional/Wholesale Enquiries: Business name, GST registration number, and trade references, where applicable.

Information Collected Automatically

When you visit the website, we may automatically collect the following:

• Technical Data: Internet Protocol (IP) address, browser type and version, operating system, device identifiers, referring URLs, and time zone settings;
• Usage Data: Pages visited, time spent on the website, links clicked, search queries, and navigation patterns;
• Cookie Data: Information collected through first-party and third-party cookies as detailed in Section 8 of this policy;
• Location Data: General geographic location inferred from IP address (no precise GPS location is collected without explicit consent).

Information from Third Parties

The Company may receive Personal Data from the following third-party sources:

• Social media platforms (e.g., Google, Facebook) where you use social login features;
• Payment processors and banks confirming successful transactions;
• Analytics and advertising partners to improve the website's performance and relevance;
• Publicly available databases for fraud prevention and identity verification.

• The Company collects and processes Your Personal Data for the following purposes and on the following legal bases:
• Performance of Contract: To process and fulfill orders, arrange delivery, process returns and refunds, and manage your account.
• Legitimate Interest: To operate, improve, and secure the website; to conduct internal analytics and market research; to prevent fraudulent transactions and enforce our Terms and Conditions.
• Compliance with Legal Obligations: To comply with applicable laws, regulations, court orders, and directions of law enforcement agencies, including the IT Act, SPDI Rules, DPDP Act, GST laws, FEMA, and any other applicable enactments.
• Consent: To send promotional communications, marketing messages, and newsletters (subject to your right to withdraw consent at any time); to deploy non-essential cookies and tracking technologies; to share data with third-party advertisers for interest-based advertising.
• Vital Interests: To protect the safety and security of users or third parties in emergency situations.

The Company does not collect SPDI unless specifically required and shall always obtain Your prior, explicit, written consent before processing the same, in accordance with Rule 5 of the SPDI Rules, 2011.

The Company does not sell, rent, or trade your personal data with third parties for their independent marketing purposes. However, we may disclose personal data in the following circumstances:

• Service Providers and Data Processors: The company engages third-party vendors who process data strictly on our instructions, including payment gateway providers, logistics and courier partners, cloud hosting services, customer relationship management (CRM) platforms, and analytics providers. Such parties are bound by appropriate data processing agreements.
• Business Transfers: In the event of a merger, acquisition, demerger, restructuring, or sale of assets, personal data may be transferred to the acquirer or successor entity, subject to continuation of this policy or a policy offering equivalent protection.
• Legal and Regulatory Disclosure: The Company may disclose Your Personal Data to governmental authorities, law enforcement agencies, courts, or regulators as required by applicable law, judicial order, or in good faith belief that such disclosure is necessary to protect the rights, property, or safety of the Company, its Users, or the public.
• Fraud Prevention and Credit Risk: Personal data may be shared with fraud prevention agencies and credit bureaus for purposes of detecting and preventing fraud or assessing credit risk.
• With Your Consent: Personal data may be shared with third parties for specific purposes where you have provided explicit consent.

The company primarily stores and processes personal data within India. In the event of any transfer of personal data outside India (for instance, to cloud services with data centers abroad), such transfer shall be effected only:

• To countries or entities notified by the Central Government as permitting data transfers under the DPDP Act, 2023, and the rules framed thereunder;
• In compliance with standard contractual clauses or equivalent safeguards as may be mandated under applicable law;
• In accordance with any restrictions imposed on the transfer of SPDI under Rule 7 of the SPDI Rules, 2011, which currently permits transfer only to entities maintaining the same level of data protection as ensured by the Company.

The Company retains Personal Data for no longer than is necessary for the purposes for which it was collected or as required under applicable law. Upon expiry of the applicable retention period, personal data shall be securely deleted, anonymized, or pseudonymized in a manner that prevents re-identification.

Types of Cookies Used

The website uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the operation of the website (e.g., session management, security). These cannot be disabled.
• Functional Cookies: Enhance functionality and personalization (e.g., remembering preferences, language settings).
• Performance and Analytics Cookies: Collect anonymous aggregated data to help us understand how users interact with the website (e.g., Google Analytics).
• Targeting and Advertising Cookies: Used to display relevant advertisements based on your browsing behavior and interests.

Managing Cookies

You may manage or disable cookies through your browser settings or via the cookie preference center available on the website. Please note that disabling certain cookies may impair the functionality of the website. For more information on how to manage cookies, you may visit www.allaboutcookies.org.

Third-Party Tracking

The website may incorporate pixels, beacons, and scripts from third-party analytics and advertising platforms (e.g., Google Ads, Meta Pixel). These third parties may independently set cookies and collect data in accordance with their own privacy policies, which we encourage you to review.

The company implements reasonable security practices and procedures as required under Section 43A of the IT Act, 2000, and the SPDI Rules, 2011, including but not limited to:

• Encryption of SPDI and financial data in transit and at rest using industry-standard protocols (TLS/SSL and AES-256);
• Secure Sockets Layer (SSL) certificates for the website;
• Role-based access controls to limit access to personal data on a need-to-know basis;
• Regular vulnerability assessments and penetration testing;
• ISO/IEC 27001 or equivalent information security management framework (where adopted);
• Documented incident response and breach notification procedures.

Notwithstanding the above, the Company does not warrant absolute security of data transmitted over the internet. In the event of a data security breach that is likely to cause significant harm to users, the company shall, to the extent required by the DPDP Act and applicable rules, notify the affected data principals and the Data Protection Board of India (upon its constitution) within the prescribed timeframe.

• Subject to applicable law, You have the following rights with respect to your personal data:
• Right to Access: You may request a summary of the personal data held by us about you and the processing activities relating to such data.
• Right to Correction: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure (Right to be Forgotten): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to overriding legal retention obligations.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
• Right to Grievance Redressal: You have the right to have your grievances addressed by the company's grievance officer expeditiously in accordance with applicable law.
• Right to Nominate: You may nominate another individual to exercise Your rights in the event of Your death or incapacity, as provided under the DPDP Act, 2023.
• Right Against Automated Decision-Making: To the extent applicable, You have the right to request human review of automated decisions that produce legal or similarly significant effects on You.

To exercise any of the above rights, please submit a written request to our Grievance Officer at the contact details provided in Section 14 of this policy. We shall endeavor to respond within thirty (30) days of receipt of a valid request. The Company reserves the right to verify your identity before processing any such request.

The company's products, including card games, may be enjoyed by players of all ages; however, the website and any online account registration, purchase, or subscription features are intended exclusively for individuals who have attained the age of eighteen (18) years.

The company does not knowingly collect personal data from children below the age of 18 years. Where a minor is permitted to use the Website under the supervision of a parent or legal guardian, it is the responsibility of such parent or guardian to provide consent and oversee the minor's use of the Website. If we become aware that personal data of a minor has been collected without verifiable parental consent, we shall take immediate steps to delete such data. Parents or guardians may raise concerns at www.parksonscartamundi.com.

The website may contain hyperlinks to third-party websites, social media pages, payment gateways, or game distribution platforms. These links are provided for your convenience. The company does not control such third-party websites and is not responsible for their content, privacy practices, or security standards. We encourage you to read the privacy policies of all external websites you visit.

The Company reserves the right to revise, modify, or update this policy at any time to reflect changes in applicable law, business operations, or data practices. Material changes shall be communicated to registered users via email or a prominent notice on the website. Continued use of the website by users after the effective date of any modification shall constitute your acceptance of the revised policy.

We recommend that you review this policy periodically. Archived versions of this policy shall be available upon written request to the Grievance Officer.

In accordance with Rule 5(9) of the SPDI Rules, 2011, and the Intermediary Guidelines, 2021, the Company has appointed a Grievance Officer to address complaints and queries relating to Personal Data and this Policy. The details of the Grievance Officer are as follows:

Name: Vivek Singhi

Company: Parksons Cartamundi Private Limited.

Registered Office Address: One International Center, Unit No. 701-A, Tower No. 1, 7th Floor, Senapati Bapat Marg, Prabhadevi, Mumbai – 400013, Maharashtra, India.

Email Address: vivek@parksonscartamundi.com

Contact Hours: Monday to Friday, 10:00 a.m. to 6:00 p.m. (IST), excluding public holidays.

Any grievance or complaint relating to the processing of personal data shall be submitted in writing to the Grievance Officer. The Company shall acknowledge receipt of the complaint within forty-eight (48) hours and shall endeavor to resolve the same within one (1) month of receipt, in accordance with the applicable provisions of the IT Act, 2000, and SPDI Rules, 2011.

If you are not satisfied with the resolution provided by the Grievance Officer, you may escalate your complaint to:

• The Adjudicating Officer appointed under Section 46 of the IT Act, 2000; or
• The Data Protection Board of India (upon its constitution under the DPDP Act, 2023); or
• The Consumer Disputes Redressal Commission under the Consumer Protection Act, 2019, for matters pertaining to e-commerce transactions.

This Policy shall be governed by and construed in accordance with the laws of the Republic of India. Any dispute arising out of or in connection with this policy shall be subject to the exclusive jurisdiction of the competent courts at Mumbai, India.

• Severability: If any provision of this Policy is held to be invalid, illegal, or unenforceable, the remaining provisions shall continue to be valid and enforceable to the fullest extent permitted by law.
• Waiver: Failure by the Company to enforce any right under this Policy shall not constitute a waiver of that right.
• Entire Agreement: This Policy, read together with the Terms and Conditions of the Website, constitutes the entire understanding between the Company and the User with respect to the subject matter hereof.
• Language: This policy is published in the English language. In the event of any conflict or inconsistency between an English version and any translated version, the English version shall prevail.

BY ACCESSING OR USING THIS WEBSITE, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREED TO BE BOUND BY THIS PRIVACY POLICY