Account

Privacy Policy

Privacy Policy


Last Updated: 30 September 2026

This Privacy Policy describes how THIRTY THIRTY SKINCARE PRIVATE LIMITED, operating the Ilumay brand (“Ilumay”, “we”, “us” or “our”), collects, uses, stores, shares and otherwise processes personal data when you visit or use www.ilumayskin.com (the “Site”), purchase our products, communicate or interact with us, participate in our programmes, surveys or feedback initiatives, or otherwise use our services (collectively, the “Services”).

For purposes of this Privacy Policy, “you” and “your” refer to the individual whose personal data we process, including customers, prospective customers, Site visitors and other individuals who interact with Ilumay.

Please read this Privacy Policy carefully. By providing personal data to us or using the Services, you acknowledge the practices described in this Privacy Policy. Where applicable law requires your consent for particular processing activities, we will seek such consent separately.

This Privacy Policy should be read together with our Terms & Conditions and any additional notices provided when we collect particular categories of personal data.

1. PERSONAL DATA WE COLLECT

The personal data we collect depends on how you interact with Ilumay. We seek to collect only information reasonably necessary for the purposes for which it is processed.

We may collect the following categories of personal data.

A. Contact and identification information

This may include your:

name;

email address;

telephone number;

billing address;

shipping address; and

other information you voluntarily provide to us.

B. Order and transaction information

When you make or attempt to make a purchase, we may collect information relating to:

  • products purchased or considered;
  • order history;
  • billing and shipping information;
  • transaction status;
  • returns, replacements, refunds and cancellations;
  • discounts, promotional codes or offers used; and
  • communications concerning your transaction.

Payments may be processed through third-party payment processors. Ilumay does not necessarily receive or store complete card, banking, UPI or other payment credentials processed directly by those providers.

C. Account information

If we offer customer accounts, we may collect information associated with your account, such as your contact information, order history, preferences and account identifiers.

Authentication credentials may be processed by our ecommerce or authentication service providers.

D. Shopping and preference information

We may collect information about products you:

  • view;
  • search for;
  • purchase;
  • add to your cart;
  • save or otherwise interact with.

We may also collect preferences that you voluntarily communicate to us, including product interests and skincare preferences.

E. Skin and product-use information

Where you voluntarily participate in product questionnaires, product feedback, the Glow Diary or similar Ilumay programmes, request assistance from us, or use any future product-selection or recommendation feature, you may choose to provide information concerning your skin, skincare routine, product use, concerns, experiences, preferences or results.

Depending on what you choose to tell us, this information may include matters such as skin type, sensitivity, appearance, uneven tone, dark spots, acne or post-acne marks, irritation, reactions to products, or other information relevant to your experience with our products. Please do not provide medical or other sensitive information unless it is reasonably necessary for the relevant interaction.

Ilumay does not intend these Services to provide medical diagnosis or treatment.

We may use information voluntarily provided by you to provide the relevant feature or support, understand product performance and customer experience, improve our products and Services, conduct internal analysis and, where separately permitted, communicate with you.

F. Communications and customer-support information

If you contact us by email, telephone, social media, website form or another communication channel, we may collect:

  • your contact information;
  • the contents of your communication;
  • information concerning your order or product experience;
  • attachments or photographs you choose to provide; and
  • our responses and subsequent correspondence.

G. Reviews, testimonials and other content

If you submit a review, testimonial, photograph, video, survey response, feedback or other content to us, we may collect and process that content together with information associated with your submission.

Where content is intended for publication, certain information may become publicly visible.

We will obtain any permissions required by applicable law before using identifiable customer content for purposes beyond those reasonably apparent when it was submitted.

H. Device, usage and technical information

When you use the Site, we and service providers acting on our behalf may automatically collect information such as:

  • IP address;
  • browser type and version;
  • device type;
  • operating system;
  • language and time-zone information;
  • referring and exit pages;
  • pages or products viewed;
  • links clicked;
  • searches performed;
  • session and interaction information;
  • cart activity;
  • approximate location derived from IP address; and
  • information concerning how you interact with the Site.
  • We may collect this information through cookies, pixels, tags, web beacons, software development kits and similar technologies.

I. Marketing and advertising information

Where permitted, we may collect information relating to:

  • advertisements you view or interact with;
  • the source through which you reached our Site;
  • marketing campaign attribution;
  • interactions with marketing emails or communications;
  • advertising identifiers; and
  • information used to measure, attribute or improve advertising performance.

J. Information from third parties

We may receive personal data from third parties that provide services to us or through which you interact with Ilumay, including ecommerce providers, payment providers, logistics providers, analytics providers, advertising platforms, social media platforms and other service providers.

The information received depends on the relevant service and your interaction with it.

2. HOW WE COLLECT PERSONAL DATA

We may collect personal data:

  • directly from you;
  • automatically when you use the Site;
  • when you purchase or attempt to purchase a product;
  • when you contact us or request support;
  • when you participate in surveys, product testing, feedback programmes, the Glow Diary or other Ilumay initiatives;
  • through cookies and similar technologies;
  • from service providers acting on our behalf;
  • from advertising, analytics and social media platforms where permitted; and
  • from other sources where permitted by applicable law.
3. HOW WE USE PERSONAL DATA

We may process personal data for lawful purposes including to:

Provide our products and Services

This includes using information to:

  • process payments and fulfil orders;
  • arrange delivery and provide order updates;
  • manage returns, refunds, replacements and cancellations;
  • provide customer support and respond to enquiries;
  • maintain customer accounts and records; and
  • provide features or programmes you request.

Operate and improve Ilumay

We may use information to:

  • operate and maintain the Site;
  • understand how customers use our products and Services;
  • improve Site functionality and customer experience;
  • analyse product and customer feedback;
  • develop, test and improve products, services and features;
  • conduct internal analytics and research;
  • troubleshoot technical issues; and
  • measure business and operational performance.

Where reasonably possible and appropriate, we may use aggregated or de-identified information for analytics, research and product development.

Communicate with you

We may communicate with you regarding:

  • orders, deliveries, returns and refunds;
  • customer-service enquiries;
  • account or security matters;
  • changes affecting our Services;
  • feedback you have provided; and
  • other administrative or transactional matters.
  • Marketing and advertising

Subject to applicable law and your communication preferences, we may use personal data to:

  • send information about Ilumay products, launches, events and offers;
  • personalise marketing communications;
  • measure the effectiveness of campaigns;
  • understand how customers discover and interact with Ilumay;
  • create or measure advertising audiences; and
  • display or facilitate advertising on third-party platforms.

Where consent is required by applicable law, we will seek that consent. You may withdraw from marketing communications using the unsubscribe mechanism provided in the communication or by contacting us. Transactional or service communications may continue where necessary to fulfil an order, provide a requested service or otherwise permitted by law.

Security, fraud prevention and protection of rights

We may use and preserve information where reasonably necessary to:

  • verify transactions;
  • detect, investigate or prevent fraud, misuse, abuse or unlawful activity;
  • protect customers, Ilumay and third parties;
  • secure our Site, systems and operations;
  • investigate suspected violations of our Terms & Conditions;
  • establish, exercise or defend legal claims;
  • respond to disputes, chargebacks or complaints; and
  • enforce our agreements and policies.

Legal and regulatory purposes

We may process information where reasonably necessary to:

  • comply with applicable laws and regulations;
  • maintain legally required records and meet tax, accounting and corporate obligations;
  • respond to valid legal processes or government requests;
  • cooperate with regulators, courts or law-enforcement authorities where required or permitted by law; and
  • protect or enforce our legal rights.
  • We may also process personal data for another purpose disclosed to you at the time of collection or where otherwise permitted by applicable law.
4. COOKIES AND SIMILAR TECHNOLOGIES

We and service providers working with us may use cookies, pixels, tags, web beacons and similar technologies to operate the Site, remember preferences, understand Site usage, perform analytics, detect problems, measure advertising performance and support marketing activities.

These technologies may collect information concerning your device and your interactions with the Site.

Some technologies are necessary for the Site and checkout to function. Others may be used for analytics, personalisation or advertising.

Where required by applicable law, we will obtain appropriate consent before placing or using non-essential cookies or similar technologies.

Your browser may allow you to block or delete cookies. Doing so may affect certain Site features or functionality.

5. ANALYTICS AND ADVERTISING

We may use analytics, attribution and advertising technologies to understand how visitors interact with Ilumay, measure marketing performance and improve our Services.

These services may process information such as device identifiers, IP address, browser information, Site interactions, referring sources, purchases or conversion events.

Advertising partners may also use information collected through cookies or similar technologies to measure advertisements or, where permitted, provide advertising that may be more relevant to you.

6. HOW WE SHARE PERSONAL DATA

We do not disclose personal data indiscriminately.

We may disclose personal data where reasonably necessary to operate our business, provide the Services or for another lawful purpose, including to the following categories of recipients.

Service providers

We may share information with organisations that perform services for us, including providers of:

  • ecommerce infrastructure;
  • website hosting and technology;
  • payment processing;
  • fulfilment and shipping;
  • customer support;
  • email and communications;
  • analytics and attribution;
  • advertising and marketing technology;
  • customer relationship management;
  • cloud storage;
  • fraud prevention;
  • security;
  • professional services; and
  • other operational services.

These parties may process information on our behalf or, depending on the service and applicable law, for their own disclosed purposes.

Logistics and fulfilment providers

We may provide information such as your name, address, telephone number, email address and order details to couriers, logistics providers, fulfilment partners and related service providers where necessary to deliver or manage your order.

Payment providers

Payment information may be provided directly to or processed by payment gateways, banks and other payment service providers necessary to complete transactions, prevent fraud, issue refunds or resolve payment disputes.

Analytics, marketing and advertising partners

Where permitted by applicable law, we may provide or make information available to analytics, advertising and marketing service providers for purposes including campaign measurement, attribution, analytics and advertising.

Professional advisers

We may disclose information to lawyers, accountants, auditors, insurers, consultants and other professional advisers where reasonably necessary for them to provide services to us or protect our legal interests.

Legal and regulatory disclosures

We may disclose personal data if we reasonably believe disclosure is necessary or appropriate to:

  • comply with applicable law;
  • comply with a court order, regulatory requirement or other valid legal process;
  • respond to a lawful request from a governmental or law-enforcement authority;
  • investigate or prevent suspected fraud, unlawful activity or security incidents;
  • enforce our agreements;
  • establish, exercise or defend legal claims; or
  • protect the rights, property, security or safety of Ilumay, our customers or others.

Nothing in this Privacy Policy requires us to disclose information where we are legally entitled or required to withhold it.

Corporate transactions

If Ilumay or its business is involved in or considering a merger, acquisition, investment, financing, restructuring, reorganisation, insolvency, sale of assets or business, due diligence exercise or similar corporate transaction, personal data may be disclosed to prospective or actual investors, purchasers, advisers, financiers or other relevant parties, subject to appropriate safeguards and applicable law.

Personal data may subsequently be transferred as part of such a transaction where permitted by law.

At your direction or with your consent

We may disclose information where you ask us to do so, consent to the disclosure or intentionally use a feature that requires disclosure to another party.

7. SHOPIFY AND ECOMMERCE INFRASTRUCTURE

Our online store may be hosted or supported by Shopify and associated ecommerce services.

Shopify and other providers involved in operating our ecommerce infrastructure may process personal data to provide their services to us and, where applicable, in accordance with their own privacy terms.

8. USER CONTENT, REVIEWS AND TESTIMONIALS

Certain Services may allow you to submit reviews, comments, photographs, videos or other content.

If you submit content to a public portion of the Site, information included in that content may be visible to other users and the public. You should therefore avoid including information you do not wish to make public.

Our use of user-generated content is also subject to our Terms & Conditions and, where applicable, any separate permission or agreement governing that content.

9. DATA RETENTION

We retain personal data for as long as reasonably necessary for the purpose for which it was collected or for another lawful purpose.

The appropriate retention period may depend on factors including:

  • the nature and purpose of the information;
  • our relationship with you;
  • whether your account or transaction remains active;
  • applicable legal, tax, accounting and regulatory requirements;
  • warranty, product-safety or consumer-protection requirements;
  • potential or actual disputes or legal claims;
  • fraud and security considerations; and
  • our need to establish, exercise or defend legal rights.

We may retain certain information after you request deletion where retention is required or permitted by applicable law, including where necessary to comply with legal obligations, maintain transaction or financial records, prevent fraud, resolve disputes or establish, exercise or defend legal claims.

Where information is no longer reasonably required, we may delete it, anonymise or de-identify it, subject to applicable law and our technical and operational requirements.

10. SECURITY

We use reasonable administrative, organisational and technical safeguards designed to protect personal data in our possession or control against unauthorised access, disclosure, alteration, loss, misuse or destruction.

Our safeguards may include access controls, technical security measures, contractual protections and appropriate internal processes having regard to the nature of the information and the risks associated with its processing.

However, no website, database, electronic transmission or storage system can be guaranteed to be completely secure. Accordingly, while we take reasonable steps to protect personal data, we cannot guarantee absolute security.

You are responsible for taking reasonable precautions when using the internet and for protecting any account credentials under your control.

If you believe that your interaction with us or your information is no longer secure, please contact us promptly at hello@ilumayskin.com

11. INTERNATIONAL PROCESSING AND TRANSFERS

Some of our service providers, technology providers or their infrastructure may be located outside India. As a result, personal data may be processed or stored in jurisdictions outside the country in which you reside.

Where we transfer or permit processing of personal data outside India, we will do so subject to applicable law and any restrictions or requirements governing such transfers.

Different jurisdictions may provide different levels of data protection.

12. YOUR RIGHTS AND CHOICES

Depending on applicable law and the circumstances of our processing, you may have rights concerning your personal data.

These may include the right to:

  • request information about personal data being processed about you;
  • request access to or a summary of certain personal data and processing activities;
  • request correction, completion or updating of inaccurate or incomplete personal data;
  • request erasure of personal data in circumstances provided by law;
  • withdraw consent where processing is based on your consent;
  • opt out of certain marketing communications;
  • raise a grievance concerning our processing of your personal data; and
  • exercise any other rights available under applicable law.
  • Withdrawal of consent will not affect processing that occurred lawfully before the withdrawal. Withdrawal may also affect our ability to provide a feature or Service where the relevant personal data is necessary to provide it.

Certain rights are subject to conditions and exceptions under applicable law. For example, we may be required or permitted to retain information notwithstanding a deletion request.

To exercise an applicable privacy right, contact us at hello@ilumayskin.com

We may request information reasonably necessary to verify your identity and process your request. We will use information provided for verification for the purpose of assessing and responding to the request and as otherwise permitted by law.

13. CONSENT AND WITHDRAWAL

Where we rely on your consent to process personal data, you may withdraw that consent in the manner made available to you or by contacting us.

We aim to make withdrawal of consent reasonably accessible and will act on valid withdrawal requests in accordance with applicable law.

Withdrawal of consent does not necessarily require deletion of information that we are required or permitted to retain under applicable law or that may lawfully be processed on another applicable basis.

14. CHILDREN

Ilumay’s products and Services are intended for adults and are not directed at children.

We do not knowingly seek to collect personal data from children in circumstances prohibited by applicable law.

If we become aware that personal data relating to a child has been collected or processed in circumstances requiring parental or guardian consent without the required consent, we will take appropriate steps in accordance with applicable law.

If you believe a child has provided personal data to us improperly, please contact us at hello@ilumayskin.com

15. THIRD-PARTY WEBSITES AND SERVICES

The Site may contain links to websites, applications, social media platforms or services operated by third parties.

We do not control and are not responsible for the privacy, security or data-processing practices of third parties operating independently of Ilumay.

The inclusion of a link does not necessarily constitute an endorsement of the third party, its services or its privacy practices.

We encourage you to review the applicable privacy policies and terms before providing information to a third-party service.

16. SOCIAL MEDIA

If you interact with Ilumay through a third-party social media platform, that platform may collect or process information in accordance with its own privacy practices.

Information you choose to publish publicly or provide through social media may be visible to the platform, Ilumay and potentially other users depending on your settings and the nature of the interaction.

Where we receive personal data from a social media platform, our processing of that information is governed by this Privacy Policy to the extent we determine how and why it is processed.

17. MARKETING COMMUNICATIONS

If you subscribe to marketing communications from Ilumay, we may send you communications about products, launches, events, editorial content, offers or other Ilumay news, subject to applicable law.

You may unsubscribe from marketing emails using the unsubscribe link contained in the relevant email or by contacting us.

Where we offer marketing through SMS, WhatsApp or another messaging service, we will provide appropriate information and opt-out mechanisms applicable to that channel.

Unsubscribing from marketing does not prevent us from sending non-promotional communications reasonably necessary in connection with transactions, orders, customer support, security or other Services you have requested.

18. PRODUCT FEEDBACK, TESTING AND RESEARCH

From time to time, Ilumay may invite customers or participants to provide product feedback, complete questionnaires, participate in consumer testing or record their experience with a product.

Participation is voluntary unless otherwise expressly stated.

Information provided through these programmes may be used to:

  • administer the programme;
  • understand product use and experience;
  • evaluate customer feedback;
  • improve existing products;
  • support research and product development;
  • develop future products or Services; and
  • generate aggregated or de-identified findings.

If Ilumay wishes to use an identifiable participant’s name, image, testimonial, photograph or other identifiable content in advertising, publicity or other external communications beyond what was reasonably disclosed when the content was submitted, we will obtain any additional permission required by applicable law.

19. FRAUD, DISPUTES AND LEGAL CLAIMS

Nothing in this Privacy Policy prevents Ilumay from collecting, preserving, reviewing, using or disclosing personal data to the extent reasonably necessary and permitted by law to:

  • investigate suspected fraud or unlawful conduct;
  • prevent abuse of our Services;
  • investigate violations of our policies or agreements;
  • respond to consumer disputes or payment chargebacks;
  • protect Ilumay, our customers or third parties;
  • preserve evidence;
  • obtain legal advice;
  • commence, pursue or defend legal proceedings; or
  • comply with a legal or regulatory obligation.

Where appropriate, information relevant to a dispute, investigation or legal claim may be retained for longer than the ordinary retention period until the matter and any reasonably anticipated related proceedings have concluded.

20. CHANGES TO THIS PRIVACY POLICY

We may modify this Privacy Policy from time to time to reflect changes in our Services, technology, business practices, legal requirements or other operational considerations.

When we make changes, we will post the updated Privacy Policy on the Site and revise the “Last Updated” date.

Where required by applicable law, we may provide additional notice or seek fresh consent before materially changing how we process personal data.

We encourage you to review this Privacy Policy periodically.

21. CONTACT US

For questions about this Privacy Policy, your personal data or our privacy practices, please contact: hello@ilumayskin.com