Privacy policy

1. Data Fiduciary & Overview

This Privacy and Data Protection Notice is published by The Layer Company ("TLC", "we", "us", or "our"), operating in India as the Data Fiduciary. This policy outlines how we collect, process, store, and safeguard digital personal data when you visit our website, commission custom 3D prints, purchase decor, or interact with our services — in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act).

2. Notice of Personal Data Collected (Section 5)

We process only digital personal data that is necessary for specified, lawful purposes:

Identity & Contact Data: Name, shipping address, billing address, email address, and phone number — for order processing and courier dispatch.
Order & Custom Manufacturing Data: Custom specifications, design notes, 3D CAD files (.STL, .STEP, .OBJ), and reference images submitted for custom manufacturing.
Transaction & Invoicing Data: Order value, itemized GST billing records, and payment transaction IDs. (Note: Sensitive card and UPI credentials are authenticated directly through RBI-compliant, licensed payment gateways and are never stored on our servers.)
Technical & Telemetry Data: IP address, device type, browser characteristics, and session identifiers collected through essential cookies.

3. Lawful Grounds & Specified Purposes (Sections 4 & 7)

Personal data is processed strictly based on your affirmative consent or for legitimate uses recognised under the DPDP Act:

Contract Performance: Precision manufacturing, quality checks, packaging, and pan-India delivery of your ordered goods.
Customer Support: Resolving pre-sale CAD inquiries, tracking shipments, and providing after-sales care.
Statutory Compliance: Generating tax invoices and maintaining financial accounts required under the Central Goods and Services Tax (CGST) Act, 2017.
Marketing & Updates (Opt-In Only): Delivering product drops, restock notices, and workshop insights only when you have explicitly subscribed. You may withdraw consent at any time.

4. Your Rights as a Data Principal (Sections 11–14)

As a Data Principal residing in India, you have the following statutory rights under the DPDP Act, 2023:

Right to Access (Sec. 11): Request a summary of your personal data we process and the identities of processors with whom it was shared.
Right to Correction (Sec. 12): Request correction of inaccurate data, completion of incomplete data, or updating of your contact records.
Right to Erasure (Sec. 12): Request deletion of your personal data once the purpose is fulfilled, unless retention is required by applicable law (e.g., GST records).
Right to Nominate (Sec. 14): Designate a nominee who may exercise your data rights in the event of your death or incapacity.
Right to Grievance Redressal (Sec. 13): Raise a complaint with our Grievance Officer before approaching the Data Protection Board of India.

5. Exercise Your Data Rights

To exercise any of the rights listed above, email us at hello@thelayercompany.com with the subject line "Data Access Request" or "Data Deletion Request" as appropriate. We will acknowledge your request within 48 hours and resolve it within 15 business days.

6. Protection of Children's Personal Data (Section 9)

The Layer Company strictly prohibits the processing of personal data of children under the age of eighteen (18) years without verifiable parental consent. We do not engage in tracking, behavioural monitoring, or targeted advertising directed towards children. If you believe a minor has submitted personal data without parental consent, please notify us immediately at hello@thelayercompany.com.

7. Data Processors & Third-Party Transfers

To deliver our e-commerce services, we share personal data only with trusted, contractually bound Data Processors:

E-Commerce & Hosting: Shopify Inc. (secure infrastructure and encrypted checkout).
Logistics Partners: Shiprocket / courier networks (strictly for physical delivery of parcels).
Payment Processors: RBI-authorised Payment Aggregators (Razorpay, Cashfree, UPI networks).

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

8. Data Retention & Security Safeguards (Section 8)

We employ robust technical and organisational security measures including TLS encryption in transit, strict role-based access controls, and regular vulnerability audits. Personal data is retained only for the duration necessary to fulfil the purpose for which it was collected, or as mandated by Indian statutory obligations — such as retaining GST-related invoices for 7 years under the CGST Act, 2017.

9. Cookie Policy

We use the following categories of cookies:

Essential Cookies: Required for core store functionality, shopping cart persistence, session security, and checkout. Cannot be disabled.
Analytics Cookies (Optional): Help us understand aggregated traffic to improve navigation — no personal identification.
Personalisation Cookies (Optional): Used for accelerated checkout and relevant product updates.

You can manage or withdraw cookie consent at any time by clicking the Cookie Preferences link in the website footer.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services, or business practices. The "Last Updated" date at the top of this page will be revised accordingly. Continued use of our website after changes are posted constitutes your acceptance of the revised policy.

Grievance Redressal Officer (Section 13, DPDP Act 2023)

In accordance with Section 8(9) and Section 13 of the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines) Rules, our Grievance Redressal Officer details are:

Designation: Grievance Redressal Officer
Email: hello@thelayercompany.com
Address: The Layer Company, Mahesh Garden, Najafgarh, New Delhi 110043, India
Response SLA: Acknowledgment within 48 hours · Resolution within 15 business days

Statutory Escalation: Under Section 13(3) of the DPDP Act 2023, if you are not satisfied with the resolution provided by our Grievance Officer, you have the right to register a complaint directly with the Data Protection Board of India (DPBI).

Last Updated: September 2025 · The Layer Company, Mahesh Garden, Najafgarh, New Delhi 110043, India