Privacy policy

Last updated: July 11, 2026

Ceven Bathworks Private Limited, trading under the brand name Thalen (“Thalen”, “we”, “us” or “our”), operates the Thalen website, online store and related services.

This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you:

  • visit or use our website;

  • create an account;

  • place or attempt to place an order;

  • communicate with us;

  • subscribe to our marketing communications;

  • submit a review or other content; or

  • otherwise interact with Thalen.

In this Privacy Policy, the website, online store, products, customer-support services and related features are collectively referred to as the “Services”.

“Personal information” means information that identifies you or can reasonably be connected with you. It does not include information that has been irreversibly anonymised or aggregated so that it can no longer reasonably identify you.

1. Who Is Responsible for Your Personal Information?

Ceven Bathworks Private Limited is responsible for determining how and why personal information collected through the Services is used, except where another organisation independently determines its own purposes for processing the information.

Our contact information is provided at the end of this Privacy Policy.

2. Personal Information We Collect

The personal information we collect depends on how you interact with us and which features of the Services you use.

Contact and identity information

This may include:

  • your name;

  • email address;

  • telephone or mobile number;

  • billing address;

  • delivery address; and

  • any other contact information you provide to us.

Order and transaction information

This may include:

  • products viewed, selected or purchased;

  • shopping-cart activity;

  • order number and order history;

  • payment method;

  • payment confirmation or failure status;

  • delivery and tracking information;

  • cancellations, returns, replacements and refunds;

  • promotional codes used; and

  • communications relating to an order.

Payment information

Payments may be processed by Shopify and/or third-party payment gateways.

Your payment provider may collect information such as your card number, bank account information, UPI information, authentication details or other financial credentials. Thalen does not ordinarily receive or store your complete card number, CVV, UPI PIN, online-banking password or similar payment credentials.

We may receive limited payment-related information, such as:

  • the payment method selected;

  • a masked card number;

  • transaction reference numbers;

  • payment status;

  • refund status; and

  • fraud or risk indicators.

The payment provider’s handling of your information is also governed by its own privacy policy and terms.

Account information

Where customer-account functionality is available, we may collect:

  • your account name;

  • email address or mobile number;

  • saved addresses;

  • account preferences;

  • order history; and

  • authentication-related information.

Passwords and certain authentication information may be handled directly by Shopify or another authentication provider. Thalen does not ordinarily have access to your unencrypted password.

Communications and customer-support information

We collect information you provide when you contact us through email, telephone, WhatsApp, social media, website forms or other support channels.

This may include:

  • the content of your enquiry;

  • photographs or documents you provide;

  • feedback and complaints;

  • delivery instructions; and

  • information needed to resolve an order or product-related concern.

We do not intend to collect medical records or detailed health information. Where you voluntarily mention an allergy, sensitivity or skin concern while seeking product support, we will use that information only as reasonably necessary to respond to your enquiry and will not use it for unrelated marketing.

Reviews and content

Where review or user-content features are available, we may collect:

  • your name or display name;

  • rating and review;

  • photographs, videos or other content you submit; and

  • information associated with the submission.

Please do not include confidential or sensitive personal information in a public review. Reviews and related content may be visible to other visitors.

Device, website and usage information

When you use the Services, we and our service providers may automatically collect:

  • IP address;

  • device type;

  • operating system;

  • browser type;

  • approximate location derived from an IP address;

  • referring website or advertising source;

  • pages and products viewed;

  • links selected;

  • date and time of visits;

  • shopping-cart activity;

  • session and interaction information; and

  • cookie, pixel and similar technology identifiers.

Marketing information

Where you subscribe to marketing or otherwise permit us to contact you, we may collect:

  • your marketing preferences;

  • your consent or subscription status;

  • engagement with emails, SMS or WhatsApp messages;

  • products or categories that may interest you; and

  • information used to measure the effectiveness of marketing campaigns.

3. How We Collect Personal Information

We collect personal information:

Directly from you

For example, when you:

  • place an order;

  • create an account;

  • subscribe to communications;

  • contact customer support;

  • complete a website form;

  • submit a review; or

  • participate in an offer, survey or promotion.

Automatically

We and our technology providers may collect information through cookies, pixels, software development kits, server logs and similar technologies when you visit or interact with the Services.

From service providers and business partners

We may receive information from:

  • Shopify;

  • payment gateways;

  • logistics and courier providers;

  • fraud-prevention providers;

  • analytics providers;

  • advertising platforms;

  • communications providers;

  • customer-support tools; and

  • social-media platforms.

For example, a courier provider may send us updated delivery-status information, and an advertising platform may tell us whether an advertisement resulted in a website visit or purchase.

4. How We Use Personal Information

We may use personal information for the following purposes.

To process and fulfil orders

This includes using information to:

  • verify and process an order;

  • process or confirm payment;

  • prepare and dispatch products;

  • provide tracking information;

  • contact you regarding delivery;

  • process cancellations, returns, replacements or refunds; and

  • maintain records of transactions.

To provide customer support

We use information to:

  • respond to enquiries;

  • provide product and order assistance;

  • investigate complaints;

  • resolve delivery or payment issues; and

  • maintain our relationship with customers.

To operate and improve the Services

We may use information to:

  • operate the website and customer accounts;

  • remember preferences and shopping-cart selections;

  • understand how visitors use the website;

  • improve website design, performance and navigation;

  • understand product interest and demand;

  • develop products and services; and

  • personalise aspects of the shopping experience.

For marketing and advertising

Subject to applicable law and your communication preferences, we may use information to:

  • send product updates, launches, offers and editorial communications;

  • send abandoned-cart or back-in-stock messages;

  • display advertisements on third-party websites and platforms;

  • measure advertising performance; and

  • create or use audiences for advertising.

Marketing communications may be delivered through email, SMS, WhatsApp or another channel you have selected or permitted.

You may opt out of promotional communications at any time by using the unsubscribe or opt-out facility in the relevant message or by contacting us. Opting out of marketing does not prevent us from sending necessary transactional communications concerning an order, payment, delivery, account or customer-support request.

For security and fraud prevention

We may use information to:

  • verify transactions;

  • detect or prevent fraud;

  • protect customer accounts;

  • identify suspicious activity;

  • maintain the security of our website and systems; and

  • protect the rights, property and safety of Thalen, our customers and others.

To comply with legal obligations

We may use or retain information to:

  • maintain tax, accounting and transaction records;

  • comply with consumer-protection and product-related requirements;

  • respond to lawful requests from courts, regulators or government authorities;

  • establish, exercise or defend legal claims; and

  • enforce our terms, policies and agreements.

Where applicable law requires a specific basis for processing, we rely on one or more of the following:

  • performance of a contract or steps taken at your request before entering into a contract;

  • compliance with a legal obligation;

  • your consent;

  • specified legitimate uses permitted by law; or

  • our legitimate business interests, where those interests are not overridden by your rights.

5. Cookies and Similar Technologies

We and our service providers may use cookies, pixels, tags and similar technologies.

These technologies may be used for:

Essential functions

These cookies are necessary for functions such as:

  • keeping the website secure;

  • maintaining your shopping cart;

  • enabling checkout;

  • processing payments;

  • remembering privacy choices; and

  • preventing fraud.

Functionality

These technologies may remember settings and preferences and provide enhanced website features.

Analytics

Analytics technologies help us understand how visitors interact with the website, which pages are visited and how the Services can be improved.

Advertising

Subject to applicable consent requirements, advertising technologies may be used to:

  • measure campaigns;

  • understand whether an advertisement resulted in a visit or purchase;

  • show advertisements that may be more relevant to you; and

  • create advertising audiences.

Where required, we will request your permission before placing or activating non-essential cookies. You may manage available choices through the cookie-preferences tool displayed on the website or through your browser settings.

Disabling certain cookies may affect website functionality. Cookies strictly necessary to operate the Services cannot ordinarily be disabled through the cookie-preferences tool.

6. How We Disclose Personal Information

We may disclose personal information only where reasonably necessary for the purposes described in this Privacy Policy.

Recipients may include:

Shopify

Our online store is hosted and supported by Shopify, which processes information to provide ecommerce hosting, checkout, security, analytics and related functionality.

Payment providers

Payment gateways, banks and payment networks may receive information required to process, authenticate, settle or refund transactions and prevent payment fraud.

Fulfilment, logistics and courier providers

We may provide your name, delivery address, telephone number, order details and other necessary information to fulfilment partners, shipping aggregators and courier companies so that an order can be delivered, tracked, returned or replaced.

Technology and service providers

This may include providers of:

  • website hosting and infrastructure;

  • data storage;

  • customer support;

  • email, SMS and WhatsApp communications;

  • analytics;

  • fraud detection;

  • review functionality;

  • account functionality;

  • website optimisation; and

  • information security.

Advertising and marketing providers

Subject to applicable law and consent requirements, certain identifiers, website activity and transaction-event information may be disclosed to advertising and analytics platforms to measure campaigns or deliver relevant advertising.

We do not sell personal information in exchange for money. However, certain advertising-related disclosures may be treated as a “sale”, “sharing” or targeted advertising under the laws of some jurisdictions. Where such laws apply, we will provide the required consent or opt-out choices.

Professional advisers and authorities

Information may be disclosed to accountants, auditors, insurers, lawyers, regulators, law-enforcement agencies, courts or government authorities where reasonably necessary or legally required.

Business transactions

Information may be disclosed in connection with a proposed or completed merger, restructuring, financing, acquisition, sale of assets, insolvency or similar business transaction, subject to appropriate confidentiality and legal protections.

We may also disclose information where you specifically direct or authorise us to do so.

7. Our Relationship with Shopify

The Services are hosted by Shopify.

Shopify processes personal information to provide and secure the ecommerce platform, facilitate transactions, prevent fraud and operate or improve its services. Information submitted through the Services may therefore be transmitted to and processed by Shopify and its authorised service providers.

In some circumstances, Shopify processes information on our behalf. In other circumstances, Shopify may determine its own purposes and means of processing and will be responsible for that processing.

Shopify may process information in countries other than the country in which you live. You can obtain more information by reviewing Shopify’s Consumer Privacy Policy and Shopify Privacy Portal.

Where Shopify features involving cross-merchant analytics, personalised advertising or network intelligence are enabled, their operation will be subject to the applicable Shopify settings, privacy controls and consent requirements.

8. International Processing and Transfers

Some of our service providers, including Shopify, analytics platforms, communications providers and advertising platforms, may process or store personal information outside India or outside the country in which you reside.

The privacy and data-protection laws in those countries may differ from those in your country.

Where required by applicable law, we and our providers will use recognised safeguards for international transfers, such as contractual protections, access controls and other technical or organisational measures. Transfers will also remain subject to any restrictions imposed under applicable Indian law.

9. Retention of Personal Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to provide the Services and satisfy legal, tax, accounting, security, warranty and dispute-resolution requirements.

The relevant retention period depends on factors including:

  • the nature of the information;

  • whether you maintain an account with us;

  • the duration of our customer relationship;

  • applicable tax and accounting requirements;

  • product, consumer and contractual obligations;

  • fraud-prevention and security requirements;

  • limitation periods for legal claims; and

  • whether a dispute or regulatory enquiry is pending.

For example:

  • order, invoice and payment-status records may be retained for the statutory accounting and tax period;

  • customer-support records may be retained for as long as necessary to resolve the matter and manage related claims;

  • account information may be retained while the account remains active and for a reasonable period afterwards;

  • marketing information may be retained until you withdraw consent or opt out, after which limited suppression information may be retained to respect your choice; and

  • security logs may be retained for the period necessary to investigate and prevent unauthorised activity.

When information is no longer required, we will take reasonable steps to delete, anonymise or securely isolate it, unless continued retention is required or permitted by law.

10. Security

We use reasonable technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, disclosure, alteration, misuse or destruction.

Depending on the nature of the information and systems involved, these measures may include:

  • restricted access;

  • authentication controls;

  • secure hosting;

  • encryption or tokenisation;

  • monitoring and logging;

  • vendor-access controls;

  • backups;

  • security reviews; and

  • incident-response procedures.

Our service providers are expected to maintain safeguards appropriate to the services they provide.

No method of internet transmission or electronic storage is completely secure. We therefore cannot guarantee absolute security. You should protect your account credentials and contact us promptly if you suspect unauthorised access to your account or personal information.

Where required by law, we will notify affected individuals and the relevant authority of a personal-data breach.

11. Children’s Privacy

The Services are intended for adults and are not directed towards persons under 18 years of age.

We do not knowingly seek to collect personal information directly from children. Persons under 18 should use the Services only with the involvement and supervision of a parent or lawful guardian.

If we learn that personal information of a child has been collected without appropriate parental or guardian involvement or consent, we will take reasonable steps to delete it, subject to legal requirements.

A parent or lawful guardian who believes that a child has provided personal information to us may contact us using the details below.

12. Your Privacy Rights and Choices

Depending on your location and applicable law, you may have the right to:

  • request information about the personal information we process and the purposes for which it is processed;

  • request access to or a copy of your personal information;

  • request correction, completion or updating of inaccurate or incomplete information;

  • request deletion or erasure of personal information;

  • withdraw consent where processing is based on consent;

  • opt out of promotional communications;

  • object to or request restriction of certain processing;

  • request portability of information in an appropriate format;

  • nominate another person to exercise applicable rights in the event of death or incapacity;

  • raise a grievance concerning the processing of personal information; and

  • appeal or complain to the competent data-protection authority, where applicable.

These rights are not absolute. We may retain or continue processing certain information where required or permitted by law, including for tax records, fraud prevention, pending transactions, legal claims and regulatory obligations.

To exercise a right, email support@thalen.in with the subject line “Privacy Request”.

Please provide sufficient information for us to identify the relevant records and understand your request. We may ask for reasonable information to verify your identity or authority before acting on a request.

Where an authorised representative submits a request, we may require evidence that the representative is authorised to act on your behalf.

We will respond within the time required under applicable law. We will not deny you products or services merely because you have exercised a privacy right, except where the information is necessary to provide the requested product or service.

13. Communication Preferences

You may stop receiving promotional emails by selecting the unsubscribe option in the email.

Where available, you may opt out of SMS or WhatsApp marketing by using the instructions provided in the message or by contacting us.

Withdrawal from marketing communications will not affect:

  • order confirmations;

  • payment notifications;

  • dispatch and delivery updates;

  • safety or product notices;

  • responses to customer-support requests; or

  • other necessary service communications.

14. Third-Party Websites and Services

The Services may contain links to websites, applications or services operated by third parties.

We do not control and are not responsible for the privacy, security or content of independent third-party services. Information you provide directly to those services will be governed by their own privacy policies and terms.

The presence of a link does not necessarily constitute an endorsement of the third party.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

  • changes to the Services;

  • changes in our data practices;

  • the addition or removal of service providers;

  • legal or regulatory developments; or

  • security and operational requirements.

The revised policy will be posted on the website with an updated “Last updated” date. Where required by law, we will provide additional notice or obtain consent before materially changing how personal information is used.

16. Complaints and Grievances

Questions, privacy requests and complaints may be sent to our Privacy and Grievance Officer.

Privacy and Grievance Officer:
R K Wadhwa 

Email: support@thalen.in
Telephone: +91 86999 84439

Please include:

  • your name and contact information;

  • a description of your concern;

  • the order or account reference, where relevant; and

  • the resolution you are requesting.

We will acknowledge and address the complaint within the period required under applicable law.

If you are dissatisfied with our response, you may have the right to escalate the matter to the appropriate data-protection, consumer-protection or other competent authority in your jurisdiction.

17. Contact Us

For questions about this Privacy Policy, our privacy practices or the exercise of your rights, contact:

Ceven Bathworks Private Limited
Trading as Thalen

1915, 2nd Floor, Sector 82 Industrial Area
Mohali, Punjab 140306
India

Email: support@thalen.in
Telephone: +91 86999 84439
Privacy and Grievance Officer: R K Wadhwa (finance@thalen.in)