Vintage Collections by Gaurav Gupta Effective date: 12 August 2026 · Last updated: 12 August 2026
Vintage Collections by Gaurav Gupta (“Vintage Collections by Gaurav Gupta“, “we”, “us”, “our”) operates the website https://www.vintagecollections.online and sells refurbished and pre-owned mobile phones, consumer electronics, and vintage collectable items.
This Privacy Policy explains what personal data we collect from you, why we collect it, how we use and protect it, who we share it with, and the rights you have over it. It is issued in accordance with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000 (including Section 43A and the Reasonable Security Practices and Procedures and Sensitive Personal Data or Information Rules, 2011), and the Consumer Protection (E-Commerce) Rules, 2020.
For the purposes of Indian data protection law, we are the Data Fiduciary in respect of your personal data, and you are the Data Principal. By using this website, placing an order, creating an account, or contacting us, you acknowledge that you have read and understood this Policy.
1. Who this Policy applies to
This Policy applies to:
visitors to https://www.vintagecollections.online and any of its subdomains;
registered account holders and customers;
persons who contact us by phone, email, WhatsApp, or social media;
persons who offer devices or collectables to us for purchase, consignment, exchange, or trade-in.
It does not apply to third-party websites, marketplaces, or social platforms that we link to. Those are governed by their own privacy policies.
Products ordered, order value, invoice details, GST number (if you request a GST invoice), delivery instructions, tracking references, refund and exchange records
When you place an order
Payment data
Payment method chosen, transaction reference ID, payment status, last four digits and card network as returned by the gateway, UPI handle where used
At checkout, via our payment gateway
Product and warranty data
IMEI or serial number of the device sold to you, condition grade, warranty start date, service and repair history
On dispatch and during any warranty claim
Communication data
Emails, WhatsApp messages, call records, chat transcripts, contact-form submissions, product reviews and ratings you post
Whenever you communicate with us
Technical and usage data
IP address, browser type and version, device type, operating system, referring URL, pages viewed, time on page, cart and session identifiers
Automatically, via cookies and server logs
Marketing data
Newsletter subscription status, consent to receive promotional SMS/WhatsApp/email, campaign engagement
When you subscribe or opt in
Seller and consignment data
Where you sell or consign a device to us: name, contact details, address, proof of identity, proof of ownership or purchase, bank or UPI details for settlement, device IMEI or serial number
When you offer a device to us
We do not collect your full card number, CVV, card expiry, UPI PIN, net-banking credentials, or one-time passwords. These are captured directly by our PCI-DSS compliant payment gateway and are never visible or accessible to us.
3. Why we process your personal data
We process your personal data only for the following specified, lawful purposes:
To fulfil your order — to accept, process, invoice, pack, dispatch, deliver, and track your purchase, and to communicate with you about it.
To operate your account — to authenticate you, maintain your order history, wishlist and saved addresses, and let you reset your password.
To process payments and refunds — to route payments through our gateway, verify successful payment, detect and prevent fraudulent transactions, and issue refunds or credit notes.
To provide after-sales support — to honour warranty claims, process exchanges and returns, arrange reverse pickups, and maintain service records against the device IMEI or serial number.
To meet legal and tax obligations — to issue GST-compliant invoices, maintain books of account, respond to lawful requests from courts, tax authorities, telecom authorities, or law enforcement, and comply with e-waste and consumer protection requirements.
To verify device provenance — to check the IMEI of every device we buy, sell, or accept in exchange against the Central Equipment Identity Register (CEIR / Sanchar Saathi) and other lawful sources, so that stolen, blocked, or tampered devices do not enter our stock.
To improve the website and our range — to understand which products and pages perform well, fix errors, and improve site performance and security.
To send you marketing communications — only where you have given us consent, and only until you withdraw it.
To protect our business — to prevent, detect, and investigate fraud, chargeback abuse, return abuse, misuse of the website, and breaches of our Terms and Conditions.
We do not sell your personal data. We do not rent, trade, or otherwise make your personal data available to third parties for their own independent marketing.
4. Consent, and how to withdraw it
Where we rely on your consent to process your personal data, that consent is sought in clear and plain language, and is limited to the specific purpose it is sought for. You may withdraw your consent at any time, as easily as you gave it, by:
clicking “unsubscribe” in any marketing email;
replying STOP to any promotional WhatsApp or SMS message;
changing your preferences in your account dashboard; or
writing to info@vintagecollections.online with the subject line “Withdraw Consent”.
Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. Where you withdraw consent for processing that is essential to a live order, a pending warranty claim, or a legal obligation, we may be unable to complete that order or claim, and we will tell you so.
Some processing does not depend on consent — for example, retaining tax invoices for the period required by law, or retaining records needed to defend a legal claim. We will continue that processing even after consent is withdrawn, and only for as long as the law requires.
5. Data on and around pre-owned devices
Because we deal in previously owned electronics, some data handling is specific to our business. Please read this section carefully.
5.1 Devices we sell to you
Every device we sell is factory reset and wiped before dispatch. We do not knowingly retain, transfer, or access any data belonging to a previous owner. If, despite this, you discover residual data of any kind on a device you have purchased from us, please stop using the device, contact us immediately at info@vintagecollections.online, and we will arrange a free pickup and secure re-processing or replacement.
5.2 Devices you send back to us
Before you return, exchange, or send in any device for warranty service, you must remove your own data from it. Specifically, you must:
back up anything you want to keep;
remove your SIM card and any memory card;
sign out of and disable iCloud / Find My iPhone / Activation Lock on Apple devices;
remove your Google account and any Factory Reset Protection (FRP) lock on Android devices;
remove any BlackBerry ID, Samsung account, Mi account, or equivalent vendor account;
perform a factory reset where the device is functional enough to allow it.
We will treat any residual data on a device you send us as confidential and will securely erase it as part of our standard intake process. However, we are not responsible for the loss, disclosure, or recovery of data you leave on a device you send to us, and we cannot recover data from a device once it has been wiped. A device that arrives still locked to your iCloud, Google, or vendor account cannot be tested, serviced, exchanged, or resold, and we will return it to you at your cost until the lock is removed.
5.3 Devices you sell or consign to us
If you sell or consign a device to us, we will record its IMEI or serial number, verify it against CEIR / Sanchar Saathi and our own records, and retain proof of your identity and ownership. We are required to be able to demonstrate lawful provenance of our stock, and we retain these records for that purpose and for the period required by law.
6. Cookies and similar technologies
Our website runs on WordPress and WooCommerce and uses cookies and similar technologies. We use:
Strictly necessary cookies — to keep your cart contents, keep you logged in, maintain your session, and secure checkout. The site cannot function without these, and they are set without consent as they are essential to a service you have requested.
Functional cookies — to remember your wishlist, comparison list, recently viewed products, and display preferences.
Analytics cookies — to understand aggregate traffic patterns and page performance.
Advertising and social cookies — where enabled, to measure the performance of our campaigns on platforms such as Meta (Facebook and Instagram), Google, and YouTube, and to show you relevant advertising.
Analytics and advertising cookies are set only where you accept them through our cookie banner. You can withdraw that acceptance at any time through the cookie preferences link in the site footer, and you can block or delete cookies through your browser settings. Blocking strictly necessary cookies will break the cart and checkout.
We honour browser-level Global Privacy Control and Do Not Track signals where they are transmitted to us in a form we can act upon.
7. Who we share your data with
We share personal data only where it is necessary, and only with the following categories of recipients:
Recipient
Data shared
Purpose
Logistics partners — Porter, Blue Dart, Delhivery, Amazon Transportation Services, Ecom Express, Ekart, and other courier partners
Name, delivery address, PIN code, mobile number, order reference, package details
Delivery, delivery OTP verification, reverse pickup, and delivery-related contact
Payment gateways and financial institutions
Order value, order reference, contact details as required by the gateway
Email address, mobile number, engagement data — only where you have consented
Sending campaigns you have opted into
Authorised service centres and technicians
Device IMEI/serial, fault description, your contact details where needed
Warranty repair and diagnostics
Professional advisers — accountants, auditors, lawyers, insurers
Only what is strictly necessary
Tax filing, audit, legal advice, insurance claims
Government authorities, courts, regulators, and law enforcement
As lawfully required
Compliance with a legal obligation, court order, or valid statutory request; establishing or defending legal claims
A purchaser of our business or assets
Customer and order records
In the event of a merger, acquisition, or sale of business, subject to the purchaser being bound by this Policy
Every processor we engage is bound by contract to process your data only on our instructions, to keep it confidential, to apply reasonable security safeguards, and to delete or return it when our engagement ends.
8. Transfers outside India
Some of our service providers — for example, cloud hosting, email delivery, analytics, and advertising platforms — may store or process personal data on servers located outside India. Where that happens, we transfer data only to countries that are not restricted by the Central Government under the Digital Personal Data Protection Act, 2023, and we require contractual safeguards from the recipient equivalent to the protections in this Policy.
9. How we keep your data secure
We apply reasonable security practices and procedures proportionate to the nature of the data we hold, including:
HTTPS/TLS encryption across the entire website, including checkout;
password hashing, and no storage of passwords in readable form;
role-based access control, so that staff can access only the data their role requires;
payment handling entirely through a PCI-DSS compliant gateway, with no card data stored on our systems;
regular software, plugin, and server patching, malware scanning, and firewall protection;
encrypted, access-controlled backups;
secure wiping of all storage media on devices entering and leaving our stock;
confidentiality obligations on all staff and contractors.
No method of transmission or storage is completely secure. While we work hard to protect your data, we cannot guarantee absolute security, and you share information with us at your own risk. You are responsible for keeping your account password confidential and for all activity under your account.
10. Personal data breaches
If a personal data breach occurs, we will notify the Data Protection Board of India and each affected Data Principal without delay and within the timelines prescribed under the Digital Personal Data Protection Rules, 2025. Our notice to you will describe the nature and extent of the breach, its likely consequences, the measures we have taken to mitigate it, and the steps you should take to protect yourself.
11. How long we keep your data
Data
Retention period
Account data
For as long as your account is active, and for 12 months after you close it or ask us to erase it, unless a longer period is required below
Invoices, tax records, and books of account
As required under the Central Goods and Services Tax Act, 2017 and other applicable tax and company law — generally up to 8 years
Order, warranty, and service records
For the life of the warranty plus 3 years, to defend against product and consumer claims
IMEI / serial and provenance records
For as long as required to demonstrate lawful sourcing of stock
Marketing consent records
Until consent is withdrawn, plus the period required to evidence that consent
Website logs and security records
Minimum 1 year, as required under the Digital Personal Data Protection Rules, 2025
Communications
3 years from the last contact, unless linked to a live dispute
When a retention period ends, we delete the data or irreversibly anonymise it.
12. Your rights
As a Data Principal, you have the right to:
Access a summary of the personal data we hold about you, how we process it, and who we have shared it with;
Correction and updating of personal data that is inaccurate, misleading, or incomplete;
Erasure of personal data we no longer need for the purpose it was collected for, or where you withdraw consent — subject to our legal retention obligations;
Withdraw consent at any time, as described in Section 4;
Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity;
Grievance redressal — to complain to us first, and to escalate to the Data Protection Board of India if you are not satisfied with our response.
To exercise any of these rights, write to info@vintagecollections.online with the subject line “Data Principal Request”, from the email address registered with your account. We may ask you for information to verify your identity before we act — we will not act on a request we cannot authenticate. We will respond within 30 days.
There is no charge for exercising your rights. We may decline a request that is manifestly unfounded, excessive, or repetitive, and we will explain why if we do.
13. Children’s data
Our products, website, and services are intended for adults. We do not knowingly sell to, or collect personal data from, anyone under the age of 18. We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children.
If you are a parent or guardian and believe a child has provided us with personal data or placed an order, contact us at info@vintagecollections.online and we will delete the data and cancel the order.
14. Marketing communications
We will send you promotional emails, SMS, or WhatsApp messages only where you have consented to receive them, or where you are an existing customer and the message relates to products similar to those you have bought. Every marketing message will carry a clear opt-out.
Our commercial communications comply with the Telecom Commercial Communications Customer Preference Regulations, 2018. Registering on the National Do Not Disturb (DND) registry will stop unsolicited commercial calls and SMS from us. It will not stop transactional messages about an order you have placed — order confirmations, dispatch notifications, delivery OTPs, and warranty updates — which we will continue to send because they are necessary to perform our contract with you.
15. Reviews and content you post
If you post a product review, rating, comment, or photograph on our website, it will be publicly visible along with the name or display name on your account. Do not include personal information in a review that you are not comfortable making public. You can ask us to remove a review you have posted at any time.
16. Third-party links and platforms
Our website links to third-party sites and platforms, including Facebook, Instagram, WhatsApp, and YouTube. We do not control those platforms and are not responsible for their privacy practices. Their handling of your data is governed by their own policies, which we recommend you read.
17. Changes to this Policy
We may update this Policy to reflect changes in our practices or in the law. The current version is always available at this URL, and the “Last updated” date at the top will change. Where a change materially affects your rights, we will notify you by email or a prominent notice on the website before it takes effect.
18. Grievance redressal and contact
If you have a question, a request, or a complaint about how we handle your personal data, contact our Grievance Officer:
Grievance Officer and Data Protection Contact Gaurav Gupta (Vintage Collections by Gaurav Gupta) Delhi Gate, Najafgarh, New Delhi – 110043, India Email: info@vintagecollections.online Phone: +91 70455 86969 Hours: Monday to Saturday, 10:00 to 19:00 IST
We will acknowledge your complaint within 48 hours and resolve it within one month of receipt, in line with the Consumer Protection (E-Commerce) Rules, 2020. You will receive a ticket reference you can use to track your complaint.
If you are not satisfied with our response, you may escalate:
Data Protection Board of India — for complaints about the handling of your personal data, at the Board’s online complaint portal.
National Consumer Helpline — 1915, or the INGRAM portal at https://consumerhelpline.gov.in
e-Daakhil — the online consumer commission filing portal at https://edaakhil.nic.in
Business details
Trading name:Vintage Collections by Gaurav Gupta Legal entity:Vintage Collections by Gaurav Gupta Registered / operating address: Delhi Gate, Najafgarh, New Delhi – 110043, India Website: https://www.vintagecollections.online Customer care: info@vintagecollections.online · +91 70455 86969
