Privacy Policy

What we collect

This policy explains how M/s B.S. Agencies (“The Fumist”, “we”) handles personal data collected through thefumist.com. We act as the data fiduciary for that data under the Digital Personal Data Protection Act, 2023.

When you order

Your name, mobile number, email address and delivery address. Also any gift note you add, whether you would like updates on WhatsApp, whether you would like our news and offers by email or on WhatsApp, and the details of your order. From our payment provider we receive the payment status, the method used (for example “UPI” or “card”) and a transaction reference.

If you reached us through a link that names a campaign (for example a post of ours on Instagram), we also note that campaign’s name, the website that sent you and the first page you saw, with your order. This tells us which of our posts and links bring orders; we never use it to build a profile of you. From 13 May 2027 we will do this only if you allowed analytics (see “Cookies and your device”).

After you order, your order page may ask how you heard about us (for example Instagram, or a friend). Answering is optional; if you answer, we keep it with your order, only to learn where people find us.

When you contact us or subscribe

What you type into our contact or newsletter forms: usually your name, email, phone number and message. We also receive what you send us on WhatsApp or by email.

When you ask to hear when a fragrance is back

Your email address and the fragrance and size you are waiting for.

When you review a fragrance

Your star rating, the words you write, the name you want shown (your first name and the first letter of your last name, unless you change it) and, only if you tick the box, the city from your order. We keep each review with its order, which is how we know it comes from a buyer.

Automatically

Like every website, our server receives your IP address and basic browser information when you visit, and our host keeps them in a short technical log. We use your IP address only to keep the site secure and to stop spam and abuse of our forms and checkout.

We also count visits without knowing who you are. When a page opens, our site tells our server which page it is (for example a fragrance’s page, or the checkout) and the type of device: phone, tablet or computer. On the first page of a visit, it also says where the visit came from: a campaign name, or the website that linked to us. It also says when a fragrance is added to or taken out of a bag. We keep only daily totals, with no ID, no IP address and nothing that can tell who you are. We do this for every visitor, so that our numbers are right.

How we use it

• To process, pack, deliver and support your order, including sending your confirmation and tracking details.
• To reply to your enquiries.
• To send our newsletter, news and offers by email or WhatsApp, and WhatsApp order updates, only if you asked for them. The boxes at checkout are never ticked for you, and a newsletter sign-up on the site only starts once you confirm it from the email we send. Every newsletter has an unsubscribe link; on WhatsApp, reply STOP; or simply tell us.
• If you joined our list, to write to you now and then about what you may like next, based on what you have bought from us: for example a reminder when a bottle may be running low, a fragrance from a family you have not tried yet, a gift idea a year after you sent one, or a greeting on a birthday or anniversary you shared with us. Never more than one such email in a day, and they stop the moment you unsubscribe.
• To learn whether our emails are useful: our newsletters and these notes contain a tiny image and links of our own that tell us whether the email was opened, which link was followed and whether an order followed within a few days. We use this only to send fewer, better emails, and to stop writing to people who no longer read them.
• If you start paying for an order and the payment does not go through, to remind you by email at most twice, with a link back to your order and a link to stop the reminders.
• If you ask us to tell you when a sold-out fragrance is back, to send you one email when it can be ordered again, with a link to cancel any other such requests. That is all: your address joins no list.
• About a week after your order is delivered, to ask you by email how you are finding it, with at most one reminder a few days later. Each of these emails has a link to stop them. We do not send them for orders sent as a gift, or once you have unsubscribed from our emails.
• To show your review on the fragrance’s page once we have read it: your rating and words, the name you chose, your city only if you asked for it, the size you bought, the month, and “Verified buyer”. We may reply under it. We publish honest reviews, good or bad; we leave out only those that are abusive, share someone’s personal details or are not about the fragrance.
• If you allow analytics: to learn which pages and fragrances interest people, where visits come from, where people leave and, if you order, what you looked at before buying. We use this only to improve our shop and our posts. We never use it for advertising or to send you messages, and never sell it.
• Unless you turn advertising off: to let Meta (Facebook, Instagram) measure which of our ads lead to visits and orders, show our ads to people likely to enjoy our fragrances, and show you fragrances you looked at. This is a separate choice from analytics, described under “Cookies and your device”.
• To keep the records that tax and accounting law requires.
• To prevent fraud and protect the site from misuse.

We do not sell, rent or trade your personal data, and we do not share it with anyone for their own marketing.

Payments

Payments are processed by Cashfree Payments India Pvt. Ltd., an RBI-authorised payment aggregator. The payment window is provided by Cashfree, so your card number, CVV, UPI PIN and banking credentials go directly to them and are never seen or stored by us. Cashfree handles that information under its own privacy policy and the security standards of the card networks.

Who we share it with

We share personal data only with the service providers we need to run the shop, and only as much as each one needs:

We may also disclose information when the law requires it, for example to a government authority acting under a valid legal order.

Cookies and your device

We use no analytics from other companies (no Google Analytics). Meta’s pixel runs unless you turn Advertising off. This site keeps a few things in your browser’s own storage; we call them cookies for short. You choose what is allowed in “Cookie settings”, at the bottom of every page: Analytics and Advertising are separate choices. Analytics is off until you choose OK; Advertising is on until you turn it off, until 13 May 2027, and from that date off until you allow it.

Open Cookie settings

Necessary (always on)

They make the shop work and stay on your device, except what you send us with an order and the anonymous counts described under “Automatically”:

• the contents of your bag
• your contact and delivery details, only if you tick “Remember me” at checkout, so you do not have to type them again. Untick it, or clear your browser’s site data, to remove them.
• a note that you have seen the opening animation, your order in progress while you pay, where your visit began (the campaign named in the link you followed, the site that sent you, the first page you saw and, if you came from a Meta ad, the click code it added to the link) and any discount code that came in that link. All of these are cleared when you close the tab. The ad’s click code goes to Meta only while Advertising is on.
• your cookie choice, for 6 months.

Counting visits (always on, no ID)

Described under “Automatically” above. Nothing about you is kept.

Analytics (only if you choose OK)

We keep a random ID on your device for 6 months. With it we record the pages and fragrances you view and when, what you add to or remove from your bag, where each visit came from and your type of device. If you then order, we link this history to your order. We do not record your IP address for analytics, or anything you type. Analytics is meant for adults: if you are under 18, please choose Turn off.

Advertising (on unless you turn it off)

Until 13 May 2027, Advertising is on unless you turn it off; from that date it stays off until you allow it. While it is on, Meta’s pixel loads on our pages and Meta sets its own cookies (_fbp, _fbc) for up to 90 days. The pixel tells Meta the pages and fragrances you view, what you add to your bag, when you open the checkout and, if you order, the order’s value and items. When you pay for an order, our server also tells Meta about the purchase, with your email, phone number, name, city, state and pincode scrambled (hashed) so Meta can match them to an account, never in plain text, and with your IP address and browser; we then delete the IP address from the order. Meta uses this to measure our ads, show them to people likely to enjoy our fragrances and show you fragrances you looked at; it may combine it with what it already knows about you, under its own privacy policy. If you choose OK, we keep a random ID on your device (the same one as for analytics) to record your choice. Advertising is meant for adults: if you are under 18, please turn it off.

Changing your mind

Choose Turn off on the card, or open “Cookie settings”, turn off what you no longer want and save. We stop at once. With Advertising off, Meta’s pixel stops, we remove its cookies from this site and we report no further orders to Meta; what Meta already received is handled under its privacy policy, and you can manage it in your Facebook or Instagram settings. With Analytics off, we stop recording and stop using what we recorded; it is then deleted on the schedule under “How long we keep it”. With nothing left on, we remove the ID from your device. Clearing your browser’s site data also removes it. We ask again after 6 months, or sooner if we change what we collect. Write to us to read this notice in another Indian language.

Cashfree’s payment window may set its own cookies to process your payment securely.

How long we keep it

• Orders and invoices: for as long as Indian tax and accounting law requires, currently up to eight years.
• Enquiries: for as long as we need to help you, and no longer than two years after our last conversation.
• Newsletter: until you unsubscribe. If our emails go unopened for about six months, we send one last note and then stop.
• Email activity (which of our emails reached you, were opened or clicked): while you are on our list, and no longer than two years after.
• Back-in-stock requests: until we send the email, and no longer than a year.
• Reviews: while they are shown on our site, and otherwise for as long as we keep the order they belong to. You can ask us to change or remove yours at any time.
• Your choices: a record of when and how you said yes or no to our messages, for as long as we keep your other details, so that we can show we only wrote to people who asked.
• Analytics (only if you said yes): 13 months from each visit, then deleted, as is the link between your visits and an order. Daily totals that cannot identify anyone may be kept longer.
• Your cookie choice: on your device, for 6 months.
• Our record of your yes to analytics or advertising, or of you taking it back: the date, the version of the notice you saw and your random ID, for 2 years after your yes ends, so that we can show we asked properly. A no is kept only on your own device.
• Advertising details on an order (only while Advertising was on): your IP address until the purchase is reported to Meta, then deleted; Meta’s browser and ad-click codes for as long as we keep the order.

After that, we delete the data or make it anonymous.

Keeping it safe

The whole site is served over an encrypted connection (HTTPS). Our order database can be reached only by our own website and by the people who fulfil orders. Order pages are protected by a private link that is sent only to you. No system is perfectly secure. If we ever learn of a breach that affects your data, we will tell you and the Data Protection Board of India, as the law requires.

Your rights

Under the Digital Personal Data Protection Act, 2023, you can:

• ask what personal data we hold about you and how we use it
• ask us to correct or update it, including a review you wrote
• ask us to delete it, a review included, except where the law requires us to keep it, such as invoices
• withdraw your consent to analytics or advertising (use “Cookie settings” at the bottom of every page), to newsletters or WhatsApp updates, or stop review requests, at any time
• nominate someone to act for you in case of death or incapacity
• raise a complaint with us. If you are not satisfied with our response, you can then go to the Data Protection Board of India.

To use any of these rights, write to our Grievance Officer, Shilpa Kandhel, at info@thefumist.com. We reply within 48 hours and act on your request within one month.

Children

Our shop is meant for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their details, please tell us and we will delete them.

We do not knowingly track or study the visits of anyone under 18, and we never target advertising at children: our ads on Meta are shown to adults only. If we learn that analytics or advertising data belongs to a child, we delete it.

Changes to this policy

If we change how we use personal data, we will update this page and the date at the top. If a change is significant, we will tell customers by email before it takes effect. If we change what analytics or advertising collects or why, we will ask for your choice again.