Cookie Policy

01 What Are Cookies and Similar Technologies?

Cookies are small data files that may be stored on or accessed from your computer, mobile phone, tablet or other device when you visit a website. They can help a website remember information about your visit or device, such as the contents of your shopping cart, session information, country or language selection, login state or other preferences.

Cookies are not the only technologies used for these purposes. Websites may also use pixels, tags, browser or local storage, software development technologies and other device identifiers. In this Cookie Policy, references to “cookies” may include similar technologies where appropriate.

A session cookie generally expires when a browsing session ends. A persistent cookie remains until its stated expiry period, until it is replaced, or until you delete it. Shopify's current merchant-cookie documentation includes technologies lasting from minutes or a browsing session to weeks or approximately one year, depending on their purpose.

02 Why Grey Exim Uses Cookies

Grey Exim and our technology providers may use cookies and similar technologies to:

• operate our ecommerce website;
• maintain shopping carts;
• support checkout and payment processes;
• authenticate customers;
• protect transactions and prevent fraud;
• remember privacy choices;
• remember language, market or currency preferences;
• measure website use and ecommerce performance;
• understand product interest;
• improve our website;
• provide optional functionality;
• measure marketing campaigns; and
• where enabled and permitted, provide or measure advertising and personalised experiences.

These purposes are particularly relevant to ecommerce functionality. Shopify's merchant-storefront documentation identifies essential store, cart, localisation, checkout, analytics and marketing technologies, while Shopify's Customer Privacy API separately controls preferences, analytics and marketing permissions.

03 Cookie Categories

Strictly Necessary Cookies

Strictly Necessary Cookies are technologies required to provide essential website or ecommerce functionality requested by you or to protect the website and transactions.

They may be used to:

• maintain your shopping cart;
• operate checkout;
• maintain a secure session;
• support customer authentication;
• apply discount information;
• remember your privacy or consent preferences;
• support country or currency selection necessary for the requested shopping experience;
• protect against fraud, abuse or tampering; and
• provide other core functions without which the requested service cannot operate properly.

Where such technology is genuinely necessary, it may remain active even if you reject optional cookies. Blocking these technologies using browser controls may prevent carts, checkout, login or other core features from working correctly.

Functional Cookies

Functional Cookies may enable additional website features or improve convenience but are not necessarily required for the basic operation of the store.

Depending on the Grey Exim configuration, functional technologies may support features such as remembering selected interface settings, optional customer functionality, wishlist behaviour or integrations requested by you.

Where a functional technology is not strictly necessary and applicable law requires consent, it will be treated as an optional technology.

Preference Cookies

Preference Cookies may remember choices such as your country, language, currency, preferred market, size or similar settings so that you do not need to re-enter those choices repeatedly.

Shopify defines its “preferences” consent category as processing used to remember customer preferences such as language, currency and size.

Depending on the purpose and applicable requirements, preference technologies may be necessary for a feature you specifically request or may be optional.

Analytics and Performance Cookies

Where enabled, Analytics and Performance Cookies help Grey Exim understand how customers interact with the website. They may help us understand:

• website visits and sessions;
• pages or product categories viewed;
• how visitors navigate the store;
• how visitors arrive at the website;
• website or checkout performance;
• errors or technical issues;
• shopping and conversion patterns; and
• aggregated trends concerning products such as scarves, bandanas, Indo-Western tops and jewellery.

Shopify defines analytics processing as information about how customers use and interact with a storefront.

Grey Exim may also use third-party analytics services such as Google Analytics where those services are actually enabled. Google Analytics' current web tagging documentation states that its recommended JavaScript implementation commonly uses first-party _ga and _ga_<container-id> cookies to distinguish users and maintain session state.

Where applicable law or our configured privacy controls require consent, optional analytics technologies will operate according to the consent choice recorded for the visitor.

Marketing and Advertising Cookies

Where enabled, Marketing and Advertising Cookies or similar technologies may be used to:

• measure advertising effectiveness;
• attribute visits or sales to marketing campaigns;
• understand engagement with advertisements;
• create advertising audiences;
• support retargeting or remarketing;
• limit or optimise advertisements; or
• provide more relevant or personalised advertising.

Shopify defines marketing processing as marketing, attribution and targeted advertising carried out by or for the merchant.

If Grey Exim uses Google Ads, Google's Consent Mode can separately control advertising storage, advertising user-data use and advertising personalisation according to the visitor's consent state.

Marketing and advertising technologies are treated as optional where consent is required. You should still be able to browse products and use basic shopping functionality when you reject optional advertising cookies, although advertisements shown elsewhere may be less tailored and measurement may be less complete.

Social Media Cookies and Pixels

Grey Exim may use social-media integrations where enabled, such as links, social plugins, sharing functionality or advertising and measurement technologies.

For example, the Meta Pixel is part of Meta's Business Tools. Meta states that its Business Tools can allow businesses to share event data for measurement and advertising, and its Cookie Policy explains that Meta can receive information when people visit third-party websites or apps that use Meta technologies.

Where a social-media integration is used solely to provide a function expressly requested by you, its treatment may differ from a technology used for behavioural advertising. Social-media pixels used for advertising, retargeting or cross-site measurement should be treated as optional marketing technologies where consent is required.

04 Providers and Third-Party Technologies

First-Party and Third-Party Cookies

A first-party cookie is generally stored for the website or domain you are visiting.

A third-party cookie or technology is associated with another provider whose technology is used by, embedded in or connected with the website.

Grey Exim's use of Shopify means that Shopify technology processes information in connection with the operation of our ecommerce store. Shopify states that its cookie banner governs Shopify-specific cookies and Shopify Pixels.

Grey Exim may also use third-party payment providers, analytics providers, advertising platforms, social-media services, ecommerce apps and logistics providers. Those providers may process technical information or use their own cookies when their services are accessed.

Manually installed third-party cookies, pixels or tracking integrated through apps may require a third-party cookie banner or additional custom consent logic.

Payment Providers

Payment processing may involve Shopify, Shop Pay and/or external payment gateways enabled by Grey Exim.

Payment providers may use cookies or similar technologies to operate checkout, maintain secure sessions, authenticate transactions, detect fraud and provide payment services.

For example, Razorpay's current 2026 Privacy Policy states that it uses session and persistent cookies to identify browsers or devices and support its services, and warns that some functionality may not operate correctly if cookies are disabled. Razorpay's buyer notice also identifies device and technical data including cookies in its payment-processing environment.

PayU likewise states that personal information can be collected through third-party cookies and through websites, platforms or checkout pages used in connection with its payment services.

A payment provider listed in this Policy is relevant only when that provider is actually enabled for the transaction. Payment-provider technologies operating on the provider's own checkout environment may also be governed by that provider's privacy and cookie practices.

Courier and Shipment-Tracking Providers

Grey Exim may use courier, fulfilment and logistics providers to deliver and track orders.

Merely sending delivery information to a courier does not mean that the courier automatically places cookies on www.greyexim.com. However, if you follow a tracking link to a courier's website, use an embedded tracking tool or otherwise interact with that provider's digital service, the provider may use its own technologies.

For example, Shiprocket states that its platforms may use temporary cookies for technical administration and related platform functions.

Where a courier or logistics provider operates an independent website, its own privacy and cookie terms will govern technologies placed on that provider's domain.

05 Cookie Consent and Your Choices

Where appropriate or required by applicable law, Grey Exim provides controls allowing you to decide whether optional cookies and similar technologies may be used.

Available choices may include:

Grey Exim does not intend to treat mere continued browsing as affirmative consent for optional tracking where affirmative consent is required.

Shopify's Customer Privacy API states that consent should be recorded only following visitor interaction, such as accepting or declining through a cookie banner, and never automatically on the visitor's behalf.

06 Managing and Withdrawing Preferences

Changing or Withdrawing Your Preferences

Where a Cookie Preferences, Privacy Choices or equivalent control is available on Grey Exim, you may use it to review and change your selections.

Shopify allows customer consent to be updated, including separate preferences for analytics, marketing and preference processing. Shopify's customer-privacy documentation also provides functionality for reopening a preferences interface.

Withdrawal of consent affects future optional processing governed by that consent. It does not necessarily delete information already lawfully processed or information that must continue to be retained for another lawful purpose.

Browser Cookie Controls

You may also control cookies through your web-browser settings.

Most modern browsers provide options to review, delete or block cookies. However, blocking all cookies at browser level can interfere with essential ecommerce features such as shopping-cart persistence, checkout, login and preference storage.

Browser controls operate separately from Grey Exim's website preference system. Therefore, changing browser settings may not create the same consent record as using the Grey Exim Cookie Preferences interface.

Google Analytics and Google Advertising Controls

Where Google Analytics is enabled, Google documents _ga and _ga_<container-id> as first-party cookies that have a default expiration of two years, although browser restrictions and configuration can change actual lifetime.

Where Google advertising or analytics tags are enabled, Grey Exim's developer configuration should communicate the appropriate consent state through Google Consent Mode or another compatible implementation. Google's current documentation supports separate controls for analytics_storage, ad_storage, ad_user_data and ad_personalization.

Do Not Track and Browser Privacy Signals

Some browsers offer a “Do Not Track” or similar setting. Because implementation of traditional Do Not Track signals is not uniform across services, Grey Exim does not promise that every third-party technology will respond identically to a generic DNT header.

Where a legally recognised or technically supported privacy signal applies, Grey Exim and our providers will handle it according to applicable requirements and configured functionality.

Shopify's current Customer Privacy API states that the Global Privacy Control (GPC) signal is automatically collected and honoured in regions configured for data-sale or sharing opt-outs.

The most reliable way to control Grey Exim's optional cookie categories is therefore to use the website's Cookie Preferences interface in addition to any browser controls.

07 Cookie Retention and International Processing

Cookie Retention

We seek to retain cookies and similar identifiers only for as long as appropriate for the purpose for which they are used, subject to provider functionality and applicable legal requirements.

Different cookies have different lifetimes. Shopify's current cookie documentation, for example, lists technologies lasting from one minute or a session to two weeks or one year, depending on the function. Google Analytics currently documents a default two-year lifetime for its common _ga identifiers, subject to configuration and browser restrictions.

Where Grey Exim controls a retention setting, we should configure it proportionately rather than retaining identifiers indefinitely.

Consent records may be retained for a reasonable period so that Grey Exim can remember your privacy preference and demonstrate the choice recorded, subject to applicable law.

International Processing and Transfers

Cookies and similar technologies used by an ecommerce platform, analytics provider, advertising service, payment provider or other technology provider may result in information being processed in countries outside India.

Where cookie-derived information constitutes personal data, Grey Exim will handle cross-border processing in accordance with applicable Indian data-protection requirements and any restrictions issued under the DPDP framework. The DPDP Act contains a specific provision concerning processing of personal data outside India.

Third-party providers may maintain infrastructure internationally and may describe their own cross-border practices in their respective privacy notices.

08 Children, Security and Personal Data Breaches

Children's Privacy

For purposes of India's DPDP framework, a child is an individual who has not completed 18 years of age. The Act contains specific provisions relating to processing children's personal data, including restrictions concerning tracking or behavioural monitoring of children and targeted advertising directed at children, subject to the Act and applicable exceptions.

Grey Exim does not intend to use optional advertising cookies, pixels or similar technologies knowingly for prohibited behavioural tracking of children or targeted advertising directed at children.

Where applicable law requires parental or guardian consent before processing children's personal data, Grey Exim will seek to apply the required mechanism.

A parent or lawful guardian who believes that a child's personal data has been collected or processed contrary to applicable requirements may contact us at info@greyexim.com.

Security of Cookie and Tracking Data

Grey Exim will take reasonable technical and organisational measures appropriate to the nature of the information processed through our website and our ecommerce environment.

Relevant controls should include secure configuration of cookies where technically applicable, access control, restricted scripts and pixels, minimisation of unnecessary trackers, appropriate use of trusted providers, software updates, vendor oversight and incident-response procedures.

CERT-In maintains Indian guidance concerning secure application development and cyber-incident management, including identification, containment, eradication and recovery considerations for cyber incidents.

No online service can guarantee absolute security.

Personal Data and Security Breaches

If a cookie, pixel, session identifier, analytics technology or related system contributes to a personal-data or security breach, Grey Exim will investigate the event, take reasonable containment and remediation measures and make notifications where required by applicable law.

CERT-In maintains statutory cybersecurity incident-reporting directions and incident-handling guidance, while India's DPDP framework separately addresses obligations concerning personal-data breaches.

Third-Party Websites

Grey Exim may provide links to payment, courier, social media or other third-party websites.

Once you leave www.greyexim.com and access an independent third-party website, that provider may place or access cookies under its own policies and settings. Grey Exim does not control cookies independently deployed by another website merely because we provide a link to that service.

09 Changes to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in:

• our ecommerce functionality;
• Shopify technology;
• installed apps or pixels;
• analytics technologies;
• advertising services;
• payment providers;
• logistics integrations;
• our privacy practices; or
• applicable legal and regulatory requirements.

When we materially revise this Cookie Policy, we will publish the updated version on our website and change the Last Updated date.

Where a material change requires a new privacy choice or renewed consent under applicable law, we will provide the appropriate mechanism.

10 Complaints and Grievance Redressal

Questions, requests or complaints concerning Grey Exim's use of cookies, pixels or personal data may be sent to:

Privacy grievances will be reviewed and handled in accordance with applicable law. India's DPDP framework contains a statutory grievance-redressal structure.