Privacy Policy

Brand: Leeway Fitness

Operated by: Lavanya Teleservices Private Limited

Registered Office: 229–230, Rajvansh Vihar, Kamal Pur, Garh Road, Meerut – 250004, Uttar Pradesh, India

Last Updated: 18 May 2026

Effective Date: 18 May 2026

🔒 At a Glance

A quick summary of what this policy says. Please read the full text below for details.

  • Who we are: Lavanya Teleservices Private Limited, acting as the Data Fiduciary for the personal data collected through www.leewayfitness.in and related channels.
  • What we collect: Your name, contact details, address, order information, GST/business details (where applicable), payment confirmation data, device and browsing information, and product reviews.
  • Why we collect it: Primarily to deliver your order, run your account, provide support, comply with the law, and, with your consent, send marketing and personalization.
  • What we don't do: We do not sell your personal data. We don't store full card details. We don't profile or target advertising at children.
  • Your rights under the DPDP Act, 2023: Access, correction, erasure, withdrawal of consent, nomination, and grievance redressal. See Section 16.
  • Your grievance contact: Mr. Abhay Rastogi, Grievance Officer, see Section 22.

About This Policy

Who we are

This Website at the URL www.leewayfitness.in (the "Website" / "Site") is owned and operated by Lavanya Teleservices Private Limited ("Leeway", "we", "us", or "our"), a company incorporated under the Companies Act, 2013, with its registered office at:

229–230, Rajvansh Vihar, Kamal Pur, Garh Road, Meerut – 250004, Uttar Pradesh, India

We are committed to protecting and respecting your privacy.

Legal framework

We collect, store, use, and otherwise process your personal data in accordance with:

  • The Information Technology Act, 2000 (21 of 2000)
  • The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules")
  • The Digital Personal Data Protection Act, 2023 ("DPDP Act") and the DPDP Rules, 2025
  • The Consumer Protection Act, 2019, and the Consumer Protection (E-Commerce) Rules, 2020
  • Any other applicable national, state, or sector-specific law that governs the processing of personal data

Our role

Under the DPDP Act, 2023, Leeway is the Data Fiduciary, and you (the user/customer) are the Data Principal whose personal data is being processed. Where third-party service providers process your data on our instructions, they act as Data Processors and are bound by contract to handle your data only as we direct.

Applicability

This Policy applies to all personal data collected through the Website, our product listings on third-party marketplaces (including Amazon.in), our social media pages, email and WhatsApp interactions, mobile interfaces, and any offline interaction related to the purchase of our products or services.

It applies to all individuals who access or use our services, including customers, visitors, vendors, suppliers, affiliates, and business partners.

By accessing the Website, placing an order, creating an account, subscribing to our newsletter, or otherwise providing your personal data to us, you confirm that you have read, understood, and agreed to this Privacy Policy along with our Terms of Service, Refund & Returns Policy, and Shipping Policy.

Definitions

For the purposes of this Policy:
Term Meaning
Personal Data Any data about an individual who is identifiable by or in relation to such data
Data Principal The individual to whom the personal data relates (i.e., you)
Data Fiduciary The person who determines the purpose and means of processing of personal data (i.e., Leeway)
Data Processor Any person who processes personal data on behalf of a Data Fiduciary
Consent Manager A Data Fiduciary registered with the Data Protection Board of India enabling Data Principals to give, manage, review, and withdraw consent
Processing Any operation performed on personal data collection, recording, organising, storing, using, disclosing, erasing, or destroying

Capitalise terms not defined here have the meaning given under the DPDP Act, 2023.

Information We Collect

We follow the principle of data minimization, collecting only the personal data necessary for the purposes described in this Policy.

Information you provide directly

When you create an account, place an order, contact support, subscribe to our newsletter, or interact with us in any other way, we may collect:

  • Full name
  • Email address
  • Phone / mobile number (for OTP, SMS, WhatsApp updates)
  • Shipping and billing address, including PIN code and landmark
  • Date of birth (only if voluntarily provided for offers)
  • GSTIN, business name, and constitution type (Individual / Proprietorship / LLP / Company) for B2B orders
  • Payment confirmation data (last 4 digits of card, transaction ID, see Section 10)
  • Product reviews, ratings, photos, videos, and feedback
  • Communications you send to us via email, phone, chat, WhatsApp, or contact forms
  • IP-claim related details (product links, trademark/IP registration details) if you submit a complaint under our IP enforcement program

Information collected automatically

When you visit the Website, we may automatically collect certain technical information using cookies, pixels, web beacons, server logs, and similar technologies:

  • Device information: operating system, device type, model, screen resolution
  • IP address (which may indicate approximate geographic location)
  • Browser type, version, and language settings
  • Date and time of access; length of visit
  • Referring URL (the website you visited before ours)
  • Pages viewed, products browsed, search queries, click-stream
  • Cookie identifiers and session data
  • Page response times, download errors
  • Interaction information scroll depth, clicks, mouse-overs, taps

Information from third-party sources

We may receive limited information about you from:

  • Marketplace platforms: (Amazon.in and others) where you have purchased our products
  • Shipping and logistics partners: updated address corrections, delivery confirmation
  • Payment gateways: transaction confirmations and fraud-screening signals
  • Analytics and advertising platforms: anonymized audience and campaign data
  • Affiliate program platform: referral and conversion data
  • Publicly available sources, such as your social-media interactions with our official pages

What we do not collect
  • We do not collect Aadhaar numbers, PAN, biometric data, or government IDs unless specifically and legally required (e.g., for high-value B2B invoicing).
  • We do not ask for or store your UPI PIN, card CVV, net-banking password, or OTPs.
  • We do not collect data about religious or political beliefs, caste, or trade-union membership.

How We Collect Information

We collect information through:

  • Direct interaction with you on the Website (account creation, checkout, forms, surveys)
  • Business interaction with you, your employees, or your authorized representatives
  • Automated technologies when you browse the Website (cookies, server logs, see Section 9)
  • Third-party sources as described in Section 3.3
  • Customer support channels: email, phone, WhatsApp, live chat

Lawful Basis for Processing

Under the DPDP Act, 2023, we process your personal data on one or more of the following lawful bases:
Basis Examples
Consent Marketing emails, WhatsApp promotional updates, newsletter, non-essential cookies, personalised recommendations
Performance of contract / Legitimate use Processing your order, arranging delivery, issuing GST invoice, handling returns and warranty claims
Legal obligation Maintaining tax, GST, and accounting records; responding to lawful requests from government authorities; consumer-law compliance
Legitimate uses under Section 7 of DPDP Act Where you have voluntarily provided data and not indicated that you don't consent; for employment-related purposes; medical emergencies; compliance with court orders

How We Use Your Information

We use your personal data primarily to provide, maintain, protect, and improve our services. Specifically, we may use it to:

Order fulfilment and account management
  • Process, manage, complete, and account for transactions (order, payment, delivery)
  • Create and maintain your online account
  • Issue tax invoices, e-way bills, and warranty cards
  • Provide pre-sales information and post-sales support

Service improvement and personalization
  • Improve the Website, products, and customer experience
  • Personalize content, product recommendations, and offers
  • Conduct internal research, analytics, and diagnostics
  • Create aggregated, anonymized data for features like "Best Seller", "Top Rated", and trend analysis

Communication
  • Send order-related communications (confirmation, dispatch, delivery, technical notices, security alerts) via email, SMS, and WhatsApp. These are service messages and continue regardless of marketing opt-out
  • Send promotional and marketing communications only where you have opted in
  • Conduct customer satisfaction surveys, NPS surveys, and feedback requests

Security, fraud prevention, and compliance
  • Detect, investigate, prevent, and address fraudulent, unauthorized, or illegal activity
  • Verify identity for high-value orders or COD verification
  • Comply with applicable laws, regulations, court orders, and lawful government requests
  • Enforce our Terms of Service and other agreements
  • Defend, establish, or exercise legal claims

Affiliate programme
  • Process your participation in our affiliate program, track referrals, and pay out commissions

We may also process personal data without your explicit consent where permitted or required by law, for example, to verify identity, prevent or investigate offenses (including cyber incidents), or comply with a court or regulatory order.

Consent & Consent Management

Obtaining consent

Where we rely on your consent, we will seek it through a clear, specific, informed, unconditional, and unambiguous consent request, accompanied by or preceding a notice that meets the requirements of the DPDP Act.

Granular consent

You may be presented with separate consent options for distinct processing activities, e.g., order processing, marketing emails, WhatsApp marketing, analytics cookies, and advertising cookies. You may grant or refuse consent for each independently.

Withdrawing consent

You have the right to withdraw your consent at any time, as easily as you gave it. You may do so by:

  • Clicking the "Unsubscribe" link in any marketing email
  • Replying "STOP" to a promotional WhatsApp message
  • Emailing support@leewayfitness.in with the subject line "Consent Withdrawal"
  • Contacting our Grievance Officer (Section 22)
  • Through a registered Consent Manager under the DPDP framework, when available

Effect of withdrawal

Upon withdrawal, we will stop processing your data for the purposes covered by the withdrawn consent. Withdrawal does not:

  • Affect the lawfulness of processing carried out before withdrawal
  • Stop us from processing data where we have another lawful basis (e.g., we must retain invoice data for tax law compliance even after you ask us to delete your account)

Notice in Indian Languages

In compliance with the DPDP Act, 2023, this Privacy Policy is published in English. On written request to our Grievance Officer (Section 22), a translated version in any of the 22 languages listed in the Eighth Schedule of the Constitution of India will be made available, where reasonably practicable.

Cookies & Tracking Technologies

What are cookies?

Cookies are small text files placed on your device by websites you visit. We use cookies and similar technologies (pixels, web beacons, local storage) to make the Website work, to remember your preferences, to analyze usage, and with your consent, to serve relevant advertising.

Types of cookies we use
Type Purpose Duration
Strictly Necessary Cart, checkout, login, security Session
Performance / Analytics Understand how visitors use the Site (e.g., Google Analytics) Up to 24 months
Functionality Remember preferences (language, recently viewed) Up to 12 months
Marketing / Advertising Serve relevant ads, measure campaigns (Google Ads, Meta Pixel) Up to 24 months

Cookie consent

On your first visit, our cookie consent banner allows you to accept, reject, or customize non-essential cookies. Strictly necessary cookies cannot be disabled as they are essential for the Website to function.

Third-party cookies

Approved third parties may set cookies when you interact with our services, including:

  • Google Analytics: anonymized website usage analytics
  • Google Ads: advertising performance measurement
  • Meta (Facebook) Pixel: social-media advertising performance
  • GoAffPro: affiliate referral tracking
  • Razor pay/payment gateway: secure payment processing

Managing cookies

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. Note that disabling certain cookies may limit Website functionality (e.g., add to cart, checkout, account login).

Do Not Track (DNT)

Some browsers offer a "Do Not Track" setting. As there is no industry-standard protocol for DNT at present, our Website currently does not respond to DNT signals.

Payment & Financial Data
  • We do not store your full card number, CVV, UPI PIN, or net-banking credentials.
  • All payment transactions are processed through PCI DSS-compliant third-party payment gateways, such as Razorpay, PayU, Cashfree, and others listed at checkout.
  • Payment information is encrypted using SSL/TLS and transmitted directly to the payment gateway. We receive only a transaction confirmation, the last 4 digits of the card (where applicable), and the transaction ID.
  • For UPI / Net Banking, the transaction is processed entirely by the gateway. We never see your UPI PIN, banking password, or OTP.
  • For Cash on Delivery (COD), no payment information is collected at the time of order placement. The amount is collected directly by the courier at delivery.

Data Sharing & Third-Party Service Providers

We do not sell your personal data

We do not sell your personal data to any third party for monetary or other valuable consideration.

Categories of recipients

We may share your data with the following categories of service providers, strictly to the extent needed for them to perform their function on our behalf:
Service Provider Type Examples Data Shared
Payment gateways Razorpay, PayU, Cashfree Name, order amount, payment method, contact details
Shipping & logistics Delhivery, Blue Dart, DTDC, Ecom Express, India Post Name, shipping address, phone number, order details
Communication / OTP Email, SMS, and WhatsApp service providers Email address, phone number, name
Analytics Google Analytics Anonymised usage data, IP address
Marketplaces Amazon.in As per the marketplace's data-sharing terms
Affiliate platform GoAffPro Referral data, order ID, payout details
Cloud / hosting Reputed hosting providers Website data (encrypted)
Customer support tools Helpdesk and CRM platforms Order and contact data
Tax / accounting Auditors, GST consultants Invoice and transaction data, on a need-to-know basis

Contractual safeguards

All Data Processors are bound by written agreements that require them to:

  • Process data only as instructed by Leeway
  • Implement reasonable security safeguards
  • Not retain data beyond the purpose
  • Notify us promptly of any data incident

Legal disclosures

We may also disclose your data when we believe in good faith that disclosure is necessary to:

  • Comply with applicable law, regulation, legal process, or governmental request
  • Enforce our Terms of Service or other agreements
  • Protect the rights, property, or safety of Leeway, our users, or others
  • Detect, prevent, or address fraud, security, or technical issues

International Data Transfers
  • Your personal data is primarily stored and processed within India.
  • In certain cases, data may be transferred to, stored, or processed outside India — for example, where our hosting, analytics, email, or CRM partners operate servers abroad.
  • Such transfers will only be made to countries or territories not restricted by the Central Government of India under the DPDP Act, 2023.
  • Where transfers are made, we shall ensure that adequate safeguards are in place (such as Standard Contractual Clauses, data-processing agreements, encryption in transit and at rest) so that your data continues to be protected at a standard equivalent to Indian law.

Data Retention

We retain your personal data only for as long as is necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, tax, audit, and reporting requirements.
Data Category Retention Period
Account information (name, email, phone, address) Until account deletion is requested, or 3 years from last activity, whichever is earlier
Order and transaction records (invoices, GST records) 8 years from date of transaction (as required under the Income Tax Act and GST laws)
Payment gateway transaction logs Retained by gateway as per their policy; we retain transaction IDs for 8 years
Customer support communications 3 years from resolution date
Marketing consent records Until consent is withdrawn, plus 1 year for audit trail
Cookie data As specified in Section 9
Website analytics data 26 months (Google Analytics default)
Affiliate programme data 3 years from last activity, or as required by tax law

At the end of the retention period, personal data will be securely deleted or anonymized. Anonymized data (which cannot identify you) may be retained indefinitely for analytical purposes.

Data Security

Our safeguards

We implement reasonable and appropriate technical, physical, and administrative safeguards to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include:

  • SSL/TLS encryption for all data in transit between your browser and our Website
  • Encryption at rest for sensitive data stored on our servers
  • Role-based access controls employees’ access to personal data only on a need-to-know basis
  • PCI DSS compliance for payment processing
  • Firewalls, intrusion detection, and continuous monitoring
  • Regular security audits and vulnerability assessments
  • Employee training on data protection and information security
  • Vendor due diligence for all third-party processors

Your role

You are responsible for keeping your account credentials confidential and for all activity that occurs under your account. We recommend:

  • Using a strong, unique password (not reused from other sites)
  • Not sharing your OTPs, passwords, or account access with anyone
  • Logging out of shared devices
  • Notifying us immediately at support@leewayfitness.in if you suspect unauthorized access

Limits of security

Despite our best efforts, no method of transmission over the Internet or method of electronic storage is 100% secure. While we use commercially reasonable means to protect your personal data, we cannot guarantee absolute security.

Data Breach Notification

In the event of a personal data breach that is likely to cause harm to any Data Principal:

  • We shall notify the Data Protection Board of India as required under the DPDP Act, 2023, and the DPDP Rules, 2025, within the timelines prescribed.
  • We shall also notify affected Data Principals (you) without unreasonable delay, with details of:
  • The nature of the breach
  • The categories and approximate number of Data Principals affected
  • Likely consequences
  • Mitigation measures we have taken or propose to take
  • Steps you can take to protect yourself
  • Contact details of our Grievance Officer for further inquiries

We maintain a documented data-breach response plan and conduct periodic drills to ensure readiness.

Your Rights as a Data Principal

Under the DPDP Act, 2023, you have the following rights with respect to your personal data:

Right to access information

You have the right to obtain a summary of your personal data being processed by us, the processing activities undertaken, and the identities of all Data Fiduciaries and Data Processors with whom your personal data has been shared.

Right to correction and erasure

You have the right to request:

  • Correction of inaccurate or misleading personal data
  • Completion of incomplete personal data
  • Updating of outdated personal data
  • Erasure of personal data that is no longer necessary for the purpose for which it was collected, except where retention is required by law

Right of grievance redressal

You have the right to a readily available means of redressal of grievances.

Right to nominate

You have the right to nominate any other individual who shall, in the event of your death or incapacity, exercise your rights under the DPDP Act on your behalf.

How to exercise your rights

To exercise any of the above rights, contact our Grievance Officer at grievance@leewayfitness.in or at the address.

  • We may need to verify your identity before processing the request (for security).
  • We will respond to a valid, verified request within 30 days of receipt, or sooner where required by law.
  • We will not charge a fee for reasonable, non-excessive requests. We may decline or charge a reasonable fee for manifestly unfounded, repetitive, or excessive requests.

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India.

Data Deletion Requests

How to request deletion

To request deletion of your personal data, email grievance@leewayfitness.in with the subject line "Data Deletion Request" and the email/phone associated with your account.

Categories of data we will delete
  • Account information (username, profile details, saved addresses)
  • Marketing consent records (kept for a 1-year audit trail, then deleted)
  • Usage data (browsing history, session logs, cookie identifiers)
  • Customer support communications, where no ongoing dispute

Exceptions: data we may need to retain

In certain circumstances, we may be unable to fully delete your data where retention is necessary for:

  • Legal compliance: tax invoices, GST records, statutory filings (must be retained 8 years)
  • Security and fraud prevention: to protect the website and users from misuse
  • Ongoing disputes or legal claims: until resolved
  • Internal operations: anonymized analytics, system backups (purged in normal cycle)

In such cases, your data will be isolated from active use and deleted at the end of the relevant retention period.

Process and timeline
  • We will acknowledge your request within 3 business days.
  • Upon verification of your identity, we will delete the eligible personal data from active records within 7 working days.
  • Backup systems may take up to 30 days to fully purge deleted data.
  • We will confirm completion of the deletion in writing.

Children's Privacy
  • Our Website and products are not directed at children below 18 years of age. We do not knowingly collect personal data from children.
  • If you are under 18, you may only use our Website with the verifiable consent of a parent or legal guardian, who agrees to these Terms on your behalf.
  • In line with the DPDP Act, 2023, we shall not:
  • Process children's personal data in a manner likely to cause detrimental effects to a child's well-being
  • Undertake tracking, behavioural monitoring, or targeted advertising directed at children
  • If we become aware that we have inadvertently collected personal data from a child without verifiable parental consent, we will take immediate steps to delete such data.
  • If you believe we hold such data, please contact us at grievance@leewayfitness.in.
  • The same protections apply, where applicable, to persons with disabilities who have a lawful guardian.

Automated Decision-Making & Profiling
  • We do not use solely automated decision-making (including profiling) that produces legal or similarly significant effects concerning you.
  • We do use limited automated tools for routine business operations, fraud screening, COD verification scoring, product recommendations, and email segmentation, but these are subject to human oversight and do not, by themselves, determine outcomes that materially affect your rights.

Marketing Communications
  • Following subscription to our newsletter or marketing list, your contact details are used for our marketing and promotional purposes until you opt out.
  • You can opt out at any time by clicking "Unsubscribe" in any marketing email, replying "STOP" to a promotional WhatsApp, or emailing support@leewayfitness.in.
  • Even after you opt out of marketing, we may still send you non-promotional service messages, order confirmations, dispatch updates, delivery notifications, support replies, security and policy notices.

Other Provisions

Links to third-party sites

Our Website may link to or from third-party websites (Amazon.in, social media platforms, payment gateways, and courier trackers). Their privacy practices are governed by their own privacy policies. We do not accept liability for those policies and encourage you to read them before sharing data.

Social network plugins

We include plugins/buttons for social networks (Facebook, Instagram, YouTube) to enable content sharing. These plugins are configured not to set cookies until you actively use them. The collection and use of any data resulting from your interaction with the plugin is governed by the relevant social network's privacy policy.

User-generated content

If you submit reviews, ratings, photos, videos, or testimonials, such content may be displayed publicly on the Website and used in our marketing materials. By submitting, you grant Leeway a non-exclusive, royalty-free, perpetual, worldwide, sub-licensable license to use, reproduce, and display the content. Please do not include sensitive personal information (full address, phone number, ID numbers) in publicly visible reviews.

Affiliate programme

If you join our affiliate programme (operated via GoAffPro), additional data (your name, email, website/social handles, payout details, referral performance) will be collected and processed in line with this Policy and GoAffPro's terms.

No sale or rental of contact lists

We do not rent, sell, or trade our email or contact lists to third-party marketers.

Grievance Officer & Contact Details

In accordance with the DPDP Act, 2023, the Information Technology Act, 2000, and the Consumer Protection (E-Commerce) Rules, 2020, the details of our designated Grievance Officer are:

Grievance Officer: Mr. Abhay Rastogi Designation: Grievance Officer, Lavanya Teleservices Private Limited Address: 229–230, Rajvansh Vihar, Kamal Pur, Garh Road, Meerut – 250004, Uttar Pradesh, India Email: grievance@leewayfitness.in Phone: +91-97200 53234 Working Hours: Monday – Saturday, 10:00 AM – 5:00 PM IST

If you have any privacy concerns, data rights requests, or grievances, please contact our Grievance Officer with a thorough description and your contact details. We will:

  • Acknowledge your grievance within 48 hours
  • Resolve the grievance within 30 days of receipt, as mandated by law

If you are not satisfied with our resolution, you may file a complaint with the Data Protection Board of India established under Section 18 of the DPDP Act, 2023.

For general (non-privacy) support, you may also reach us at support@leewayfitness.in.

Changes to This Policy
  • We may update or modify this Privacy Policy from time to time to reflect changes in law, regulation, technology, or our business practices.
  • We will indicate changes by updating the "Last Updated" date at the top of this Policy.
  • For material changes, we will provide additional notice through a prominent banner on the Website, an email to registered users, or both.
  • The version of the Policy in effect at the time of your transaction or interaction governs that transaction.
  • Continued use of the Website after such changes constitutes acceptance of the updated Policy.

Governing Law & Jurisdiction

This Privacy Policy is governed by and shall be construed in accordance with the laws of India. Any disputes arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the competent courts at Meerut, Uttar Pradesh, India, subject to any rights and forums available to you under the DPDP Act, 2023, including the Data Protection Board of India.

By using www.leewayfitness.in, you acknowledge that you have read, understood, and agreed to this Privacy Policy, along with our Terms of Service, Refund & Returns Policy, and Shipping & Delivery Policy.