Privacy Policy
SENSORY STUDIO (a brand of Comfort Grid Technologies Private Limited)
Effective Date: 17 September 2026 | Last Updated: 17 September 2026
1. INTRODUCTION
We respect your privacy, and your privacy is important to us. This website https://sensorystudio.in and the "Sensory Studio" mobile application, stores and customer-support channels (collectively, the "Website" or "Services") are owned and operated by Comfort Grid Technologies Private Limited under its brand name "Sensory Studio" ("Company", "We", "Us", "Our", "Sensory Studio").
This Privacy Policy explains what Personal Data we collect, why we collect it, how we use, store, disclose and otherwise process it, and the rights and choices available to you. It has been prepared with reference to the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 and rules made thereunder, together with other applicable Indian laws.
By accessing or using the Services, you confirm that you have read, understood and agree to this Privacy Policy.
2. DEFINITIONS
| Term | Meaning |
|---|---|
| "You" / "Your" / "User(s)" | Any natural or juristic person who accesses, browses, registers on, or uses the Services, including purchasers of our Products. |
| "Products" | Products available on the Website, including but not limited to comfort-space items such as duvets, bedspreads, mattress protectors, pillows, comforters and other allied products. |
| "Personal Data" / "Personal Information" | Any information that relates to a natural person, which, directly or indirectly, alone or in combination with other information, identifies, or can be used to identify, contact or locate that person — including name, address, phone number, email address, identification number, password, financial/payment information, purchase history, IP address, cookies and other online identifiers. |
| "Sensitive Personal Data or Information (SPDI)" | A sub-category of Personal Data comprising passwords, financial information (bank account/card details), physical, physiological and mental health information, sexual orientation, medical history, and biometric information. |
| "Digital Personal Data" | Personal Data in digital form, or non-digital Personal Data that is subsequently digitised, as governed by the DPDP Act. |
| "Data Fiduciary" | The person who, alone or with others, determines the purpose and means of processing of Personal Data. The Company acts as the Data Fiduciary in respect of your Personal Data collected through the Services. |
| "Data Principal" | The individual to whom the Personal Data relates. Where the individual is a child, "Data Principal" includes the parent or lawful guardian of such child. |
| "Data Processor" | Any person who processes Personal Data on behalf of a Data Fiduciary. |
| "Processing" | Any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, combination, restriction, erasure or destruction. |
| "Third Party" | Any person or entity other than you and the Company, including vendors, service providers, advertising partners, affiliates and government authorities. |
| "Cookies" | Small text files or similar technologies placed on your device by a web server to store preferences, session data and usage analytics. |
| "Controller" | Used interchangeably with "Data Fiduciary" in this Policy. |
3. ABOUT US
The Company operates the Website and associated mobile applications and, where applicable, physical stores across India.
| Registered Name | Comfort Grid Technologies Private Limited (operating the "Sensory Studio" brand) |
| CIN | [U24304MH2019PTC333446] |
| Registered Office | 7th Floor, Techweb Centre, New Link Rd, Oshiwara, Jogeshwari West, Mumbai, Maharashtra 400102, India |
| care@sensorystudio.in | |
| Phone | +91 7208497857 |
| Grievance Officer / Data Protection Contact | grievance@sensorystudio.in |
4. SCOPE OF THIS PRIVACY POLICY
This Policy applies to Personal Data collected from current, former and prospective customers, Website/app visitors, purchasers of Products, and participants in our surveys, competitions or promotions, whether collected online through the Website/app or offline (for example, through our customer-support channels).
This Policy does not apply to information collected by third-party websites, applications or payment gateways that may be linked from or to our Services; we encourage you to review their respective privacy policies. If you access our Services from outside India, you do so at your own initiative and risk, and you are responsible for compliance with applicable local law.
5. PERSONAL DATA WE COLLECT
5.1 Data You Provide Directly We collect Personal Data you voluntarily provide when you register or create an account; place an order, make a payment, or request a refund or return; subscribe to newsletters or promotional communications; contact our customer-service team via phone, email, chat or social media; participate in surveys, competitions, promotions or events; submit reviews, ratings or feedback; or request product information or support.
Categories include:
- Identity data: full name, date of birth, gender
- Contact data: email address, mobile number, billing and shipping address
- Financial data: payment details and transaction information (processed via our payment gateway partners)
- Transactional data: order history, product preferences, returns, warranty claims
- Account credentials: username, encrypted password
- Communication data: content of emails, chat transcripts, customer-service communications
- Preference data: wish lists, marketing opt-ins
5.2 Data Collected Automatically When you use our digital Services, we automatically collect: IP address and device information; browser type and language; referral/exit pages and pages viewed; date/time stamps and click-stream data; approximate location derived from IP address (and precise location only if you separately enable it); and website usage information collected through cookies and similar technologies.
5.3 Data Received from Third Parties We may also receive Personal Data from social media platforms (if you log in via a social account), payment service providers confirming transaction status, logistics/courier partners providing delivery updates, and analytics/advertising partners sharing aggregated or anonymised insights.
6. HOW AND WHY WE USE YOUR PERSONAL DATA
We process Personal Data only for specified, clear and lawful purposes, and we do not process Personal Data beyond what is necessary for those purposes (data minimisation), consistent with the DPDP Act. The table below sets out our purposes, the categories of data involved, and the basis on which we rely.
| Purpose | Type of Personal Data | Basis |
|---|---|---|
| Order fulfilment - processing purchases, payments, deliveries, returns and refunds | Identity, contact, financial, transactional | Performance of contract |
| Account management - creating and maintaining your account | Identity, contact, credentials | Performance of contract; legitimate use |
| Customer service - responding to queries, complaints, warranty claims | Identity, contact, communication | Legitimate use; performance of contract |
| Marketing & promotions - newsletters, offers, personalised recommendations | Identity, contact, preference, behavioural | Consent |
| Analytics & product development - improving the Website/app, personalising experience | Behavioural, technical, transactional | Legitimate use |
| Security & fraud prevention -detecting/preventing fraud, protecting accounts and assets | Identity, technical, transactional | Legitimate use; legal obligation |
| Legal & regulatory compliance - tax, accounting and other statutory obligations | Identity, financial, transactional | Legal obligation |
| Reviews & ratings | Identity, preference, communication | Consent; legitimate use |
| Competitions & events | Identity, contact, image/video | Consent; legitimate use |
| Verification messages / OTPs - validating your account and preventing misuse | Identity, contact | Performance of contract; legitimate use |
Under the DPDP Act, "legitimate use" (rather than open-ended "legitimate interest") is a narrower ground that covers, among other things, situations where you have voluntarily provided data for a specified purpose and have not indicated you do not consent, compliance with law, medical emergencies, and similar defined situations — we rely on it only where it genuinely applies, and on your consent for all other processing, particularly marketing.
7. CONSENT
By providing your Personal Data through the Website, or by using the Website, you consent to its collection and processing for the purposes set out in this Policy. Where we rely on consent, such consent will be free, specific, informed, unconditional and unambiguous, given through clear affirmative action, and we will provide you an itemised notice (in English and, where feasible, other languages) describing the Personal Data to be collected and the purpose of processing, at or before the point of collection, as required under the DPDP Act.
You may withdraw consent at any time, and withdrawal will be as easy as giving it. To withdraw consent, write to us at care@sensorystudio.in. Withdrawal will not affect the lawfulness of processing carried out before withdrawal. Please note withdrawal may restrict your ability to use certain features of the Services or may lead to us being unable to continue providing goods or services for which the data was necessary.
8. COOKIES, WEB BEACONS AND TRACKING TECHNOLOGIES
8.1 What are cookies? Cookies are small text files or similar technologies (including web beacons, pixel tags and local storage) that a website stores on your device to recognise you across visits, remember preferences and personalise your experience.
8.2 Types of cookies we use
| Cookie Type | Purpose |
|---|---|
| Strictly Necessary | Core site functionality — login sessions, shopping cart, secure checkout. Cannot be disabled. |
| Functional | Remembers preferences (language, region) and enables enhanced features. |
| Analytics / Performance | Aggregated, anonymised data on how visitors use the site, to help us improve it. |
| Targeting / Advertising | Tracks browsing to deliver relevant ads on our site and third-party platforms, and to measure campaign effectiveness. |
| Social Media | Enables content-sharing on social networks and may track visits originating from social platforms. |
8.3 Managing cookies. Most browsers let you manage cookie preferences, erase cookies, block them, or receive a warning before one is stored. Disabling certain cookies may limit some features. Where consent is required by law for non-essential cookies, we will obtain it through a cookie-consent mechanism before such cookies are set.
8.4 Third-party cookies. We do not control cookies placed by third parties, including advertising partners, and encourage you to review their respective privacy policies.
9. MARKETING, ADVERTISING AND ANALYTICS PARTNERS
9.1 Direct marketing. Where you have consented, we send promotional communications — newsletters, offers, new-product announcements, and booking/order confirmations — via email, SMS, WhatsApp, app/web push notifications, and, where applicable, postal mail. You may opt out at any time via the unsubscribe link, your account settings, or by contacting customer service.
9.2 Advertising partners. We may work with advertising and analytics platforms (such as Google, Meta and similar networks) that use cookies, JavaScript, pixel tags and other technologies to collect data about your interactions with the Services and to display targeted advertisements. Where we share a customer identifier (e.g., a hashed email address or device ID) with an advertising partner for retargeting, it is processed using cryptographic hashing; if no match is found, the shared data is securely discarded. Each advertising partner is independently responsible for its own processing, and we encourage you to review their policies. Where required by applicable law, such personalised advertising will be subject to your consent.
9.3 Analytics. We use analytics tools (such as Google Analytics or similar) to understand website traffic and user behaviour, configured to anonymise IP addresses where possible.
10. DISCLOSURE OF PERSONAL DATA
We do not trade, sell or rent your Personal Data. We share it only as described below and, where required by law, subject to your consent:
10.1 Within the Company. Your Personal Data may be shared between departments or group entities of the Company on a need-to-know basis, strictly for the purposes in this Policy.
10.2 Service providers / Data Processors. We engage vetted third parties (Data Processors) to perform functions on our behalf, including: payment gateways and card-processing companies; logistics and courier partners; IT infrastructure and cloud-hosting providers; marketing-automation and messaging services; CRM/help-desk platforms; outsourced customer-support providers; security and fraud-detection providers; and analytics/research firms. All such Data Processors are contractually bound to process Personal Data only under our written instructions, to implement appropriate security safeguards, and to assist us in meeting our obligations under the DPDP Act (including breach notification and honouring Data Principal rights requests routed through us).
10.3 Legal and regulatory disclosure. We may disclose Personal Data to government authorities, courts, regulators, the Data Protection Board of India, or law-enforcement agencies where required by law, court order or regulatory directive, or in good-faith belief that disclosure is necessary to comply with legal process, enforce this Policy, respond to claims of rights violations, protect the rights or safety of the Company, its Users or the public, or investigate fraud or unlawful activity. Any such disclosure is limited to what is necessary for the applicable purpose, and the recipient is prohibited from publishing or further sharing the data beyond that purpose.
10.4 Business transfers. In a merger, acquisition, restructuring or sale of assets, your Personal Data may be transferred to the successor entity, which will be required to honour the commitments in this Policy and process the data only for the purposes for which it was originally collected, or as otherwise permitted by law.
11. CROSS-BORDER TRANSFER OF PERSONAL DATA
We may store or process your Personal Data on servers located outside India, or share it with service providers located outside India, for the purposes described in this Policy. The DPDP Act permits the transfer of Personal Data outside India except to countries specifically restricted by the Central Government from time to time. Where we transfer Personal Data internationally, we will do so only to jurisdictions not so restricted, and we will require the recipient to maintain a standard of protection consistent with this Policy and applicable law.
12. DATA RETENTION
We retain Personal Data only for as long as necessary to fulfil the purpose for which it was collected, including to satisfy legal, accounting, tax or regulatory requirements, or as otherwise required by the DPDP Rules for specified classes of data fiduciaries.
| Category of Data | Retention Period |
|---|---|
| Active account and transactional data | Duration of the customer relationship, plus up to 7 years for legal/tax purposes |
| Marketing preferences and communications | Until consent is withdrawn or deletion is requested, whichever is earlier |
| Customer service interactions | Up to 3 years from the date of interaction |
| Call/voice recordings | Maximum 28 days, unless required for a legal claim |
| Technical/log data and cookies | Up to 12 months from collection |
| Backup systems | May persist beyond a deletion request due to technical constraints, subject to routine backup-rotation and secure deletion schedules |
Where the purpose of processing is no longer being served and retention is not otherwise required by law, we will erase the Personal Data or render it non-identifiable, consistent with the DPDP Act's data-minimisation and storage-limitation principles. Where you close your account or withdraw consent, and no legal basis for retention applies, we will similarly erase your Personal Data within a reasonable period.
13. DATA SECURITY
We implement reasonable security safeguards — physical, administrative and technical — appropriate to the nature and sensitivity of the Personal Data we process, including: SSL/TLS encryption for data in transit; PCI-DSS-aligned handling of payment data; role-based access controls; regular vulnerability assessments and security audits; firewalls, intrusion-detection and anti-malware tools; employee training on data protection; and physical security controls at our offices and facilities.
No method of transmission or storage is completely secure, and while we use commercially reasonable measures, we cannot guarantee absolute security.
14. DATA BREACH NOTIFICATION
In the event of a personal data breach, we will take reasonable steps to contain and remediate it, and will notify the Data Protection Board of India and affected Data Principals in the manner, form and timeline prescribed under the DPDP Rules, including a description of the nature of the breach, the likely consequences, and the measures taken or proposed to mitigate the risk.
15. YOUR RIGHTS AS A DATA PRINCIPAL
Subject to applicable law, you have the following rights in relation to your Personal Data. To exercise any of these, contact our Grievance Officer using the details in Section 23.
| Right | Description |
|---|---|
| Right to Access Information | You may request a summary of the Personal Data we hold about you and the processing activities undertaken, and, where applicable, the identities of Data Processors with whom it has been shared. |
| Right to Correction and Updating | You may request correction of inaccurate or misleading Personal Data, completion of incomplete data, and updating of your data — or do so directly through your Account settings. |
| Right to Erasure | You may request erasure of Personal Data that is no longer necessary for the purpose for which it was collected, unless retention is required by law or for resolving disputes. |
| Right to Grievance Redressal | You may raise a grievance regarding our processing of your Personal Data with our Grievance Officer, and, if unresolved, escalate it to the Data Protection Board of India. |
| Right to Nominate | You may nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity, by writing to us. |
| Right to Withdraw Consent | You may withdraw consent at any time, as easily as it was given (see Section 7). |
| Right to Restrict / Object to Processing (where based on legitimate use) | You may ask us to limit or object to processing that is not based on your consent, where you believe the underlying ground no longer applies. |
| Right Regarding Automated Decisions | Where we make a decision about you using solely automated means with a significant effect, you may request meaningful information about the logic involved and request human review. |
We will acknowledge requests promptly and aim to respond within the timelines prescribed under applicable law.
16. MANAGING YOUR ACCOUNT INFORMATION
You may review and update the Personal Data in your account at any time by logging into "My Account," including your name, contact details, addresses, payment methods and marketing preferences. Please note that residual copies of information you ask us to remove or change may persist for a limited period in backup systems due to technical constraints; such data is subject to the retention schedule in Section 12 and is not actively used for any purpose.
17. PROTECTION OF CHILDREN'S DATA
Under the DPDP Act, a "child" is any individual who has not completed 18 years of age. Our Services are intended for use only by individuals who are 18 years of age or older, and are not directed at, or intended for use by, children. We do not knowingly collect or process Personal Data of anyone under 18.
Consistent with the DPDP Act, we do not undertake tracking or behavioural monitoring of children, or serve targeted advertisements directed at children, and, in the limited circumstance that we become aware we have inadvertently collected a child's Personal Data, we will take steps to promptly delete it and, where applicable, deactivate the relevant account.
If you believe a minor has submitted Personal Data to us, please contact our Grievance Officer immediately. Parents and guardians are encouraged to supervise their children's online activity and to use available parental-control tools.
18. AUTOMATED DECISION-MAKING
Where we use automated means (including profiling) to make decisions that produce legal or similarly significant effects concerning you — for example, in fraud checks — we will provide, on request, meaningful information about the logic involved, and you may request human review, as described in Section 15.
19. FORCE MAJEURE
The Company shall not be held responsible for any loss, damage or misuse of your Personal Data attributable to circumstances beyond its reasonable control, including acts of God, fire, flood, earthquake, pandemic, epidemic, war, riots, civil commotion, sabotage, acts of government or regulatory authority, computer hacking, unauthorised access, computer crashes, or breach of encryption or security ("Force Majeure Event").
20. LOG FILES
Our servers automatically record log data whenever you visit the Website, including IP address, browser type and version, ISP, pages visited, date/time stamps, and referring/exit pages. We use this data to analyse trends, administer the site, diagnose technical issues, track visitor movement, and gather demographic information. This data is not linked to identifiable individuals except where necessary for compliance, security, or fraud prevention.
21. LINKS TO THIRD-PARTY WEBSITES
The Services may contain links to third-party websites, social media platforms and payment gateways. This Policy applies only to our own Services; we have no control over, and accept no responsibility for, the privacy practices of linked third-party sites. Please review their privacy policies before sharing any Personal Data with them.
22. LOYALTY / MEMBERSHIP PROGRAMMES (WHERE APPLICABLE)
If the Company offers a loyalty or membership programme, participation is voluntary. On enrolment, we process additional Personal Data (such as purchase history and reward-points balance) to administer the programme and provide personalised offers. You may terminate membership at any time by contacting us; upon termination, related Personal Data will be deleted per Section 12, subject to any overriding legal obligation.
23. GRIEVANCE REDRESSAL MECHANISM
In accordance with the Information Technology Act, 2000 and the DPDP Act, complaints, concerns or queries regarding the collection, use, storage, disclosure or handling of your Personal Data may be directed to our Grievance Officer:
| Designation | Grievance Officer |
| care@sensorystudio.in | |
| Phone | +91 7208497857 |
| Address | 7th Floor, Techweb Centre, New Link Rd, Oshiwara, Jogeshwari West, Mumbai, Maharashtra 400102, India |
If your grievance is not resolved to your satisfaction, you may approach the Data Protection Board of India through the process it prescribes.
For complaints relating to Products, orders, deliveries, returns or refunds (rather than data-privacy matters), please refer to our separate Customer Grievance Redressal Policy on the Website.
24. CHANGES TO THIS PRIVACY POLICY
We may update this Policy from time to time. Updates will be posted on the Website with a revised "Last Updated" date and will take effect upon publication, unless otherwise stated. Where a change is material and required by law, we will notify you by email or a prominent notice on the Website. Any changes will not reduce the level of protection previously promised without appropriate notice and, where required, your consent.
25. GOVERNING LAW AND JURISDICTION
This Privacy Policy is governed by and construed in accordance with the laws of India, including the Information Technology Act, 2000 (as amended) and the Digital Personal Data Protection Act, 2023, and the rules made thereunder. Subject to any mandatory consumer-protection law, disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the competent courts at Mumbai, India.
26. HOW TO CONTACT US
| care@sensorystudio.in | |
| Phone | +91 7208497857 |
| Post | New Link Rd, 7th Floor, Techweb Centre, Oshiwara, Jogeshwari West, Mumbai, Maharashtra 400102, India |
| Website | https://sensorystudio.in |
Acknowledgement: By using our Services, you confirm that you have read, understood and agree to this Privacy Policy.