Privacy Policy

Toqse ("Toqse", "we", "us", "our") runs an online store for intimate wellness, beauty, skin, hair, fragrance and personal care products, together with an optional product membership and referral programme (direct selling). This policy explains how we collect, use, share, store and protect your personal data when you use our website www.domina.shop, our mobile apps, and related services (together, the "Platform").

It applies to everyone who uses the Platform: visitors, customers who buy products, and members who join the referral programme. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), Toqse is the Data Fiduciary and you are the Data Principal.

By creating an account, placing an order, submitting KYC or otherwise using the Platform, you confirm that you have read and understood this policy. Please also read our Terms of Service.

We only collect what we need to run the store, deliver your orders, and operate the membership programme lawfully.

Account information

• Full name, mobile number and email address.
• One-time passwords (OTPs) used to verify your mobile number and sign you in.
• Your system-generated Member ID, referral code and referral link.
• The referral code you used when signing up, and who referred you.

KYC and identity information (members)

• Date of birth, gender and residential address (city, state, PIN code, country).
• PAN number, the name on your PAN, and a copy of your PAN card.
• Aadhaar number, the name on your Aadhaar, and copies of the front and back of your Aadhaar card.
• Nominee details: name, relationship, phone number and date of birth.

Bank and payout information (members)

• Account holder name, account number, account type, bank name, branch and IFSC.
• UPI ID, UPI-linked phone number or UPI QR code, and your payout preference.
• Tax records linked to your PAN, including TDS deducted on your earnings.

Orders, payments and delivery

• Products and kits you order, cart and wishlist items, invoices and credit notes.
• Shipping name, phone number and delivery address, including PIN code.
• Payment references and status from our payment gateway. We do not see or store your full card number, CVV, UPI PIN or net-banking password.
• Shipment booking numbers and tracking events from India Post.
• Return and refund requests and their outcomes.

Membership activity

• Your position in the referral network and the members placed under you.
• Commission, milestone and reward entries, wallet balance, and withdrawal requests.
• Records of the agreements you accept, with the date, time and IP address of acceptance.

Things you send us

• Messages sent through our contact form (name, mobile, email, topic and message).
• Product reviews and ratings, and testimonials you agree to share.
• Your email address if you subscribe to our newsletter.

Technical information

• IP address, device and browser type, operating system and app version.
• Pages visited, time of access, and server and security logs.

We use your personal data for these specific purposes:

• To create and secure your account and sign you in with OTP.
• To process your orders and payments, issue GST invoices, and ship your products.
• To handle returns, refunds, cancellations and customer support.
• To verify your identity (KYC) before you can share your referral link or receive earnings, as required for direct selling.
• To place new members in the referral network and calculate commissions, milestones and rewards.
• To deduct and deposit tax (TDS) and file statutory returns using your PAN.
• To pay your withdrawals into your bank account or UPI.
• To send you order updates, OTPs, invoices and service messages by SMS, WhatsApp or email.
• To send newsletters and offers, only if you have chosen to receive them.
• To prevent fraud, misuse, duplicate accounts and unauthorised access.
• To understand how the Platform is used so we can improve it.
• To meet our legal obligations and respond to lawful requests from authorities.

We process your personal data on the basis of your consent, which you give when you sign up, submit KYC, accept agreements, or subscribe to updates. Your consent is free, specific and informed, and is limited to the purposes described here.

We may also process data without separate consent for legitimate uses allowed under Section 7 of the DPDP Act, such as complying with tax, consumer protection and direct selling laws, responding to court orders, or preventing fraud.

You can withdraw consent at any time (see Your rights). Withdrawal does not affect processing that happened before it. If you withdraw consent needed for KYC or payouts, we may not be able to continue your membership or pay out earnings.

We do not sell or rent your personal data. We share it only where needed to provide our services or where the law requires it.

Service providers

• Cashfree Payments to process payments and refunds.
• India Post to book, ship and track your parcels.
• MSG91 and messaging partners to deliver OTPs, SMS and WhatsApp messages.
• Email providers to send transactional and support emails.
• Cloud hosting and storage providers to run the Platform and store files securely.
• Banking and IFSC verification services to confirm your bank details.
• Accountants, auditors and legal advisers for tax, GST and statutory compliance.

These providers may use your data only to perform services for us and must keep it confidential and secure.

Within the referral network

Members above and below you in the network may see limited details such as your name, Member ID and joining status, so that referrals can be tracked. We never show your phone number, email, address, PAN, Aadhaar, bank details, or earnings to other members.

Public content

Product reviews you post may be shown publicly with your display name and city. Reviews are moderated before they appear.

Authorities

We may disclose data to courts, the Income Tax Department, GST authorities, law-enforcement agencies, the Data Protection Board of India, or other authorities when we are legally required to.

Business changes

If Toqse is merged, acquired or restructured, your data may move to the new owner, who will remain bound by this policy. We will tell you before that happens.

• Aadhaar numbers and bank details are encrypted when stored.
• Your account screens only show masked values, such as the last four digits.
• KYC documents can be viewed only by authorised staff for verification, and every review is recorded in an audit log.
• We use Aadhaar only to verify your identity and address. We do not use it for any other purpose or share it with other members.
• We use PAN for identity checks and for tax deduction and reporting as required by law.

The Platform uses your browser's local and session storage, and a small number of essential cookies, to:

• Keep you signed in securely.
• Remember your cart and wishlist.
• Save a draft of your KYC form so you do not lose your progress.
• Remember the referral code you arrived with during signup.
• Complete your payment and return you to your order.

We do not use third-party advertising cookies or sell your browsing data. You can clear this data from your browser settings at any time, but you will be signed out and your cart may be emptied.

We keep personal data only as long as we need it for the purposes above, or as long as the law requires:

• Invoices, orders, payments, TDS and GST records: 8 years from the end of the relevant financial year, as required by tax laws.
• KYC, agreement and membership records: while your account is active, and up to 8 years after it is closed, for legal and dispute purposes.
• Commission, wallet and withdrawal records: 8 years, or longer if a dispute is open.
• Contact form messages: up to 3 years after the matter is closed.
• Newsletter email: until you unsubscribe.
• Server and security logs: usually up to 180 days.

After that, we delete or anonymise the data so it can no longer identify you.

• All traffic to and from the Platform is encrypted with HTTPS.
• Sign-in uses OTP verification and short-lived access tokens.
• Sensitive fields such as Aadhaar and bank details are encrypted at rest.
• Staff access is role-based and limited to what each person needs for their job.
• Administrative actions, KYC reviews and payouts are recorded in audit logs.
• Repeated failed OTP attempts are rate-limited and accounts are temporarily locked.

No online system is completely secure. Please never share your OTP with anyone, including people who say they are from Toqse. We will never ask for your OTP, card PIN or UPI PIN. If you think your account has been misused, contact us immediately.

If a personal data breach occurs, we will inform the Data Protection Board of India and affected users as required by the DPDP Act.

Under the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you and how we use it.
• Correct or update inaccurate or incomplete data. You can edit much of it from your profile.
• Erase data that is no longer needed, subject to legal retention periods.
• Withdraw consent for processing that is based on consent.
• Nominate someone to exercise your rights if you die or become unable to do so.
• Raise a grievance with us, and then with the Data Protection Board of India.

To use any of these rights, write to info@domina.shop from your registered email, or use our contact form. We may ask you to confirm your identity first. We aim to respond within 30 days.

You can ask us to close your account and delete your data at any time by contacting us. Before we close it, we will settle any open orders, refunds and eligible wallet balances.

Some records, such as invoices, tax records, KYC proofs and agreement acceptance records, must be kept for the periods required by law, even after the account is closed. Your position in the referral network may be kept in anonymised form so that other members' records stay accurate.

We send service messages such as OTPs, order confirmations, invoices, shipping updates, KYC status and payout updates by SMS, WhatsApp or email. These are part of the service and cannot be switched off while your account is active.

We send newsletters and promotional offers only if you opt in. You can unsubscribe at any time using the link in the email or by contacting us.

The Platform is meant for people aged 18 and above. Only adults can register, complete KYC or join the membership programme. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

Your data is primarily stored and processed in India. If a service provider handles any data outside India, we make sure the transfer is allowed under Indian law and that the provider protects it to the same standard as this policy.

We may update this policy when our services or the law change. When we do, we will update the "Last updated" date above. If the change is significant, we will also notify you by SMS, email or a notice on the Platform before it takes effect.

In line with the Information Technology Act, 2000, the Consumer Protection (E-Commerce) Rules, 2020 and the DPDP Act, 2023, you can contact our Grievance Officer with any concern about your personal data or this policy:

• Grievance Officer, Toqse
• Email: info@domina.shop
• Contact form: www.domina.shop/contact
• Hours: Monday to Saturday, 10:00 AM to 6:00 PM IST

We will acknowledge your complaint within 48 hours and try to resolve it within 30 days. If you are not satisfied with our response, you may approach the Data Protection Board of India.