Privacy Policy

1. Overview

Orivva (“Orivva”, “we”, “us”, or “our”) is a wellness and direct-selling company. We care deeply about your privacy and the trust you place in us, whether you visit our website, buy our products, or build a distributor business with us.

This Privacy Policy explains how we collect, use, share, retain, and protect your personal data when you use our websites, apps, dashboards, and related services (collectively, the “Service”). It is designed to comply with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and other applicable laws. By using the Service, you acknowledge this Policy. If you do not agree, please do not use the Service.

2. Who We Are

Orivva is the Data Fiduciary for personal data processed in connection with the Service. We determine the purposes and means of processing your personal data.

For privacy questions, rights requests, or grievances, email contact@orivva.com. We also maintain a grievance redressal channel described in the “Your Rights” and “Contact Us” sections below.

3. Scope

This Policy applies to personal data we process about:

• Website and marketing visitors.

• Customers and prospective customers who browse, inquire about, or purchase Orivva products.

• Independent distributors / network marketers, including applicants and active members of our compensation plan.

• Nominees, sponsors, and other individuals whose details you provide in connection with registration, KYC, or payouts.

• Administrators and authorised staff who operate the Service.

This Policy does not apply to third-party websites, apps, or services we do not control. Independent distributors act as independent business operators; where they collect data for their own purposes outside our platform, they are responsible for their own compliance (see Section 10).

4. Information We Collect

Information you provide to us

Depending on how you use the Service, this may include:

• Identity and contact details: full name, phone number, email address, title, gender, date of birth, and profile details.

• Account credentials: password and authentication data used to access your account (we do not store passwords in plain text).

• Shipping and address details: delivery address, landmark, city, district, state, pincode, and shipping phone number.

• Communications: messages you send to support, feedback, complaints, and preferences.

• Nominee details: nominee name, relationship, and, where required, identity information for succession or compliance.

Distributor, KYC, and business information

If you join or operate as a distributor, we may collect additional information required for identity verification, tax compliance, compensation, and regulatory obligations under India’s direct selling framework, including:

• Government identity data: PAN, Aadhaar (or masked Aadhaar where permitted), GST number (if applicable), and related document images.

• Bank and payout details: bank name, account holder name, account number, IFSC, branch, account type, UPI ID, and bank proof (such as passbook or cancelled cheque images).

• Network and compensation data: sponsor and placement details, distributor code, package information, PV and team metrics, earnings, ranks, and payout history.

• Onboarding and verification records: KYC status, rejection reasons, activation status, and related audit logs.

Orders, payments, and billing data

When you place an order, request a package, or receive a payout, we process order details, payment status, payment method, references, and (where submitted) payment proof. Payments may be handled by third-party processors such as Razorpay and, where enabled, Stripe. We do not store full payment card numbers on our servers. We may receive limited processor data such as transaction IDs, last four digits, expiry month/year, and billing status to prevent fraud and keep accounts in good standing.

Information collected automatically

When you use the Service, we automatically collect device and usage information, including IP address, browser type, device identifiers, pages viewed, referring URLs, approximate location (country or region), session activity, and performance or diagnostic data. We use cookies and similar technologies to operate the Service, keep you signed in, remember settings, and measure performance. See the “Cookies and Similar Technologies” section below.

Information from third parties

• Payment processors and banks (payment status, risk signals, payout confirmations).

• Service providers (cloud hosting, file storage for KYC images, analytics, support tools).

• Sponsors or authorised distributors who initiate onboarding or placement for a new member (limited contact details needed to complete registration).

• Publicly available sources or verification partners, where lawful and necessary for fraud prevention or KYC.

5. Health and Wellness Information

Orivva sells herbal and nutritional wellness products. We are not a hospital, clinic, pharmacy, or licensed medical practitioner, and purchasing or using our products does not create a doctor–patient relationship.

• We do not require clinical medical records, prescriptions, lab reports, or diagnoses to create an account or place a standard product order.

• If you voluntarily share health-related information (for example in a support message or product inquiry), we treat it as confidential, process it only for the purpose you shared it (such as responding to your query), and do not use it to make medical decisions about you.

• Product information on our Service is for general wellness education and is not medical advice. Always consult a qualified healthcare professional for personal health decisions.

6. How We Use Your Information

We use personal data only for clear, legitimate business purposes, including to:

• Provide, maintain, secure, and improve the Service and customer experience.

• Create and manage accounts, authenticate users, and provide support.

• Process product orders, package activations, shipping, returns, and customer service.

• Onboard distributors, verify KYC, place members in the network, and operate the compensation plan (including PV, matching, bonuses, ranks, and payouts).

• Calculate and remit applicable taxes (including TDS), maintain financial records, and meet direct-selling and other legal obligations.

• Send transactional notices, security alerts, order updates, and service communications.

• Monitor and prevent fraud, abuse, duplicate accounts, and security incidents.

• Analyze performance, fix bugs, and develop new features.

• With your consent or as permitted by law, send marketing or promotional communications. You can opt out at any time.

• Generate aggregated, de-identified, or anonymized insights that do not identify you.

7. Lawful Processing (India, EEA and UK)

India (Digital Personal Data Protection Act, 2023)

• Consent: where required, we seek free, specific, informed, and unambiguous consent. You may withdraw consent at any time, subject to legal and contractual retention needs.

• Certain legitimate uses under the DPDP Act: for example, to provide the Service you request, comply with law, prevent fraud and security incidents, or other uses permitted by the Act and Rules.

EEA/UK (GDPR/UK GDPR)

Where these laws apply, we may rely on:

• Contract: to provide the Service you request.

• Consent: where you have given consent, which you may withdraw.

• Legitimate interests: to secure, improve, and operate the Service, balanced against your rights.

• Legal obligation: to comply with applicable laws.

• Vital interests: in rare cases to protect someone’s safety.

8. KYC, Identity, and Financial Data

Government IDs, KYC documents, and bank details are sensitive and are handled with heightened care. We collect them only when needed to verify identity, enable payouts, prevent fraud, and comply with tax and direct-selling requirements.

• Access is restricted to authorised personnel and systems on a need-to-know basis.

• Document images and identity numbers are stored using security controls appropriate to their sensitivity.

• We do not sell KYC or bank data. We share it only with processors or authorities as required to provide payouts, verify identity, or comply with law.

• You must provide accurate KYC information. Providing false or stolen identity data may result in account suspension and legal action.

9. Payments and Payouts

We use third-party payment processors to handle collections and, where applicable, payouts securely. Our primary processor is Razorpay, and we may also use Stripe or bank transfer methods (such as NEFT/IMPS) for distributor payouts. These companies process payment data under their own privacy policies. We do not store full card numbers on our servers.

• Razorpay Privacy Policy: https://razorpay.com/privacy/

• Stripe Privacy Policy: https://stripe.com/privacy

10. Direct Selling Network and Distributor Obligations

Orivva operates a direct-selling / network marketing model. Limited network information is necessary for the business to function, for example, sponsor relationships, placement in the binary structure, and team performance summaries.

What may be visible in the network

• Sponsors and authorised upline members may see limited business information about downline distributors (such as name, code, join date, package status, and team metrics) needed to support and manage the organisation.

• Sensitive KYC documents, full bank account numbers, Aadhaar images, and passwords are not shared with other distributors for marketing or recruitment.

Duties of independent distributors

If you are a distributor and collect personal data of customers, prospects, or recruits in connection with your Orivva business, you must:

• Comply with this Policy, Orivva’s policies and procedures, and applicable data protection laws, including the DPDP Act.

• Provide clear notice and obtain any required consents before collecting or sharing personal data.

• Use personal data only for legitimate Orivva business purposes, not for unrelated marketing, harassment, or sale to third parties.

• Keep prospect and customer data confidential and secure; do not disclose it to unauthorised persons.

• Not sell, rent, lease, or trade personal data obtained through your Orivva activity.

Failure to protect personal data may result in disciplinary action under our distributor agreement, including suspension or termination, and may expose you to legal liability.

11. Cookies and Similar Technologies

We use cookies, local storage, and similar technologies to operate the Service, remember your preferences, keep you signed in, and measure performance. You can control cookies through your browser settings. If you disable cookies, parts of the Service (including secure account access) may not work properly.

• Essential: required for basic site functionality, security, and authentication.

• Preferences: remember choices such as language and theme.

• Analytics: help us understand usage and improve performance.

For more detail on cookies, retention, and consent choices, see our Cookie Policy.

12. Analytics and Logs

We may use analytics and logging tools to understand how the Service is used, improve reliability, and investigate security events. These providers may set cookies or collect identifiers and usage information under their policies.

For example, Google Analytics privacy information is available at Google Privacy and Terms.

13. Sharing and Disclosure

We do not sell your personal data. We share information only as needed to operate the Service, support the direct-selling network, comply with law, or protect our rights.

• Service providers that help us operate the Service (hosting, storage, authentication, communications, analytics, support).

• Payment processors and banks for collections, payouts, and fraud prevention.

• Limited network sharing with sponsors/upline as described in Section 10.

• Professional advisors, auditors, or insurers under confidentiality.

• Law enforcement, regulators, or courts where required by law or to protect rights, safety, or property.

• Business transfers, such as a merger, acquisition, or asset sale, subject to appropriate safeguards.

• With your consent or at your direction.

We may share aggregated or de-identified information that does not identify you.

14. Data Retention

We retain personal data only as long as necessary for the purposes described in this Policy, or as required by law. Retention periods vary by data type:

• Account and profile data: for the life of the account and a reasonable period afterward to resolve disputes or meet legal obligations.

• Order, payment, earnings, and tax records: typically retained for the periods required under Indian tax, company, and direct-selling compliance rules.

• KYC and identity documents: retained while you are a distributor and for a lawful period after account closure for fraud prevention, audit, and regulatory purposes.

• Marketing preferences: until you withdraw consent or we no longer need them.

• Security and audit logs: for as long as reasonably needed to investigate incidents and maintain system integrity.

When data is no longer required, we delete or de-identify it using secure methods, subject to backup and legal hold exceptions.

15. Security

Protecting your data is a core responsibility for Orivva. We use technical and organizational measures designed to protect personal information, including encryption in transit, access controls, monitoring, and secure handling of KYC and financial data. No method of transmission or storage is fully secure, and we cannot guarantee absolute security. If we become aware of a personal data breach that requires notification, we will act promptly and notify the Data Protection Board and affected individuals as required by applicable law.

You also play a role: keep your password confidential, use a strong unique password, and tell us immediately if you suspect unauthorised access to your account.

16. International Transfers

We may transfer, store, and process your information in India and in other countries where our service providers operate (for example, cloud hosting, content delivery, or payment infrastructure). Where required, we use appropriate safeguards and take steps to ensure a level of protection consistent with applicable law, including any government restrictions on cross-border transfers under the DPDP Act and Rules.

17. Your Rights

General rights

• Access, correction, and erasure of your personal data, subject to legal exceptions.

• Withdrawal of consent where processing is based on consent.

• Grievance redressal within a reasonable time.

• Nomination of another person to exercise rights on your behalf in the event of death or incapacity, where provided by law.

India (Digital Personal Data Protection Act, 2023)

• Right to access, correction, and erasure of personal data.

• Right to grievance redressal within a reasonable time.

• Right to withdraw consent and to nominate a representative.

• If unresolved, you may approach the Data Protection Board of India.

EEA/UK (GDPR/UK GDPR)

Where these laws apply, you may also have rights to restriction, objection, and data portability, and the right to lodge a complaint with your local supervisory authority. We will respond to valid requests within applicable timeframes.

California (CCPA/CPRA)

California residents may have rights to know, delete, correct, and opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information. We do not sell personal information for money. Where we share information with service providers, we do so under contracts that limit their use.

How to exercise your rights

To submit a request, email support@orivva.com. We may need to verify your identity before responding. Certain requests may be limited by law. For example, we may need to retain KYC, tax, or payout records even after an erasure request.

18. Your Choices

• Marketing communications: use the unsubscribe link in the message or contact us to opt out.

• Cookies: control cookies via your browser settings.

• Account: update profile details in your dashboard where available, or contact us to close your account.

• Distributor KYC: keep your documents current; outdated or inaccurate KYC may delay payouts.

19. Children’s Privacy

The Service is intended for adults. You must be at least 18 years old to create an account, become a distributor, or purchase as a business participant. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will take appropriate steps to delete it. For users in the EEA, the minimum age may be higher under local law.

20. Do Not Track

Some browsers offer a Do Not Track signal. There is no uniform standard for responding to these signals, so we do not respond to them at this time. You can control cookies through your browser settings.

21. Third-Party Links

The Service may contain links to other websites or services. We are not responsible for the privacy practices of those websites. We encourage you to review their policies before sharing personal data.

22. Changes to This Policy

We may update this Policy to reflect changes to our practices, products, technologies, or legal requirements. If we make material changes, we will post the updated Policy here and update the “Last updated” date above. Where required by law, we may also notify you through the Service or by other reasonable means. Your continued use of the Service after the effective date means you accept the changes.

23. Contact Us

If you have questions, concerns, or grievances about this Policy or our data practices, contact us at:

Privacy / general: contact@orivva.com

Rights requests / support: support@orivva.com

We aim to acknowledge and resolve privacy grievances in a fair and timely manner. If you are not satisfied with our response, you may escalate as permitted under the DPDP Act, including to the Data Protection Board of India where applicable.