Privacy Policy

1. Who We Are

This Privacy Policy applies to Icon Plaza, a shopping, dining, and entertainment destination located at Shrirampuri, Bhagwanpur, Muzaffarpur, Bihar 842001, India, operated by its management entity ("Icon Plaza", "we", "us", or "our").

This policy covers personal information collected through:

• Our website at iconplaza.in and all subpages
• The Icon Rewards mobile application (Android and iOS)
• In-mall promotional and loyalty programmes
• Marketing forms, competitions, and events (including Icon Shopping Carnival)
• Our official social media accounts

By using any of these services, you agree to the collection and use of your information as described in this policy.

2. Data We Collect

We collect information you provide directly and information generated automatically when you use our services.

Information you give us:

• Identity data: Full name, display name
• Contact data: Mobile phone number (including +91 numbers), email address
• Participation data: Purchase invoices, invoice photos, shopping receipts submitted to competitions or loyalty programmes
• Verification media: Screenshots or photos uploaded as part of promotional activities (e.g., Instagram follow verification)
• Profile data: Loyalty programme preferences, spending history, redemption history
• Communications data: Messages, queries, or feedback you send us

Information collected automatically:

• Device type, operating system, browser type, and version
• IP address and approximate location (city/region level)
• Pages visited, time spent, and navigation paths on our website
• App usage data: session duration, features used, push notification interactions
• Cookies and similar tracking technologies (see Section 7)

3. How We Use Your Data

We use your personal information for the following purposes:

• Service delivery: Running the Icon Rewards loyalty programme, processing competition entries, issuing confirmation codes, and managing prizes
• Account management: Creating and managing your loyalty account, verifying your identity, and enabling app login via OTP
• Marketing and promotions: Sending you offers, event invitations, new store announcements, and competition updates through the channels you have opted into (see Section 4)
• Competitions and events: Verifying eligibility, drawing winners, announcing prizes, and administering Icon Shopping Carnival and other promotions
• Customer support: Responding to your queries, complaints, and feedback
• Analytics: Understanding how visitors use our website and app to improve the experience
• Legal compliance: Meeting our obligations under applicable Indian law, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023

4. Marketing Communications

We may contact you on your registered mobile number and email address to share:

• Promotional offers, discounts, and sale announcements from Icon Plaza and its tenant stores
• Loyalty programme updates: coin balances, tier upgrades, reward redemption reminders
• Competition and event notifications: Icon Shopping Carnival draws, winner announcements, event reminders
• New store and restaurant openings at Icon Plaza
• Seasonal campaigns: Diwali, Eid, New Year, and other festive offers
• Exclusive member-only previews and early access notifications

SMS: We may send transactional and promotional text messages to your registered mobile number. Standard messaging rates may apply from your carrier.

WhatsApp: By sharing your phone number with us, you consent to receiving messages from Icon Plaza on WhatsApp. These may include offers, reminders, and updates. You can stop WhatsApp messages at any time by sending "STOP" to our WhatsApp number or by contacting us at care@iconplaza.in.

Push Notifications: If you install the Icon Rewards app and grant notification permissions, we will send push notifications about your loyalty points, new offers, competitions, and mall updates. You can manage notification preferences within the app's Settings at any time.

Email: We will send transactional emails (confirmation codes, competition entries, loyalty summaries) and marketing emails to your registered address.

Opting Out: You may withdraw your marketing consent at any time by:

• Replying STOP to any SMS from us
• Messaging STOP on WhatsApp
• Disabling push notifications in the Icon Rewards app settings or your device settings
• Clicking the Unsubscribe link in any marketing email
• Emailing us at care@iconplaza.in

Opting out of marketing communications will not affect transactional messages (e.g., competition confirmation codes, OTP verifications, loyalty account updates), which we may still send as they relate to services you have specifically requested.

5. Sharing Your Data

We do not sell your personal data. We may share it only in the following limited circumstances:

• Service providers: Third-party platforms that help us operate — including cloud hosting providers, email delivery services, SMS gateway providers, WhatsApp Business API providers, analytics tools, and payment processors. These parties process data only on our instructions and are bound by data processing agreements.
• Tenant stores: We may share aggregated, anonymised footfall and spending data with our mall tenants for business purposes. We do not share individually identifiable information with tenant stores without your explicit consent.
• Prize partners: Where a competition prize is provided by a brand or sponsor, your name and contact details may be shared with that partner solely for the purpose of prize fulfilment.
• Legal authorities: Where required to comply with applicable law, court order, or government request.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to equivalent privacy protections.

6. Mobile App (Icon Rewards)

The Icon Rewards app is available on Android and iOS. In addition to the data described above, the app may collect:

• Phone number (mandatory): Used for OTP-based login and as your primary account identifier. Your phone number may be used to send you loyalty updates, promotional offers, and important account communications via SMS, WhatsApp, and push notifications.
• Display name: Chosen by you on first login; shown on the leaderboard
• Device token: Used to deliver push notifications specific to your device
• App usage data: Which features you use, how often you visit, and which notifications you interact with — used to improve the app experience

The app uses Firebase (Google LLC) for authentication, database, and cloud storage services. Firebase's privacy policy is available at firebase.google.com/support/privacy.

You may delete your app account at any time by contacting us at care@iconplaza.in. Upon deletion, your personal data will be removed from our active systems within 30 days, subject to any legal retention obligations.

7. Cookies & Tracking

Our website uses cookies and similar technologies to:

• Remember your preferences (e.g., announcement bar dismissal)
• Understand how visitors navigate the site (via analytics tools such as Google Analytics)
• Improve page performance and personalise content

Essential cookies are required for the site to function and cannot be disabled. Analytics cookies are non-essential — you may decline these by adjusting your browser settings or using a cookie opt-out tool.

Most browsers allow you to refuse or delete cookies through their settings. Note that disabling cookies may affect some website functionality.

8. Data Retention

We retain your personal data for as long as necessary for the purposes set out in this policy:

• Active accounts: Retained for the duration of your account, plus a reasonable period after your last interaction
• Competition entries: Retained for 12 months after the competition closes, or longer if required for prize dispute resolution
• Marketing consent records: Retained for 3 years from the date of consent, as evidence of your permission
• Transaction and invoice data: Retained for 7 years in line with standard Indian accounting and tax requirements
• Uploaded media (photos/screenshots): Retained for 6 months after the relevant promotion ends, then deleted

After the relevant retention period, data is securely deleted or anonymised.

9. Your Rights

Under the Digital Personal Data Protection Act, 2023 (DPDPA) and other applicable Indian law, you have the following rights regarding your personal data:

• Right to access: Request a copy of the personal data we hold about you
• Right to correction: Ask us to correct inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data, subject to legal retention requirements
• Right to withdraw consent: Withdraw marketing consent at any time (see Section 4)
• Right to grievance redressal: Lodge a complaint with our Grievance Officer (see Section 13)
• Right to nominate: Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity

To exercise any of these rights, email us at care@iconplaza.in with "Data Privacy Request" in the subject line. We will respond within 30 days.

10. Children's Privacy

Our website, app, and loyalty programme are intended for users aged 18 and above. We do not knowingly collect personal data from children under 18 without verifiable parental or guardian consent.

If you believe we have inadvertently collected data from a minor, please contact us immediately at care@iconplaza.in and we will delete it promptly.

11. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• HTTPS encryption across all website and app traffic
• Firebase security rules restricting data access by authenticated users only
• OTP-based authentication for account login
• Access controls limiting internal data access to authorised personnel only

No method of electronic transmission or storage is 100% secure. While we use commercially reasonable measures to protect your data, we cannot guarantee absolute security. In the event of a data breach that is likely to cause harm, we will notify affected users as required by applicable law.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Post a notice on our website or app
• Where required by law, notify you directly via email or SMS

Your continued use of our website or app after the effective date of any changes constitutes your acceptance of the updated policy.

13. Contact & Grievance Officer

If you have any questions, concerns, or complaints about this Privacy Policy or how we handle your data, please contact our Grievance Officer as required under the Information Technology Act, 2000: