Privacy Policy

Privacy Policy


1.  Introduction

Layers Electronics Private Limited (“Layers”, “Company”, “we”, “our” or “us”) is the Data Fiduciary responsible for the personal data described in this Privacy Policy. We act as the Data Fiduciary in respect of personal data collected through our website at www.layers.shop, our Anarc and Anarc 2 smartwatches, the Layers companion mobile application (the “App”), and our customer-support channels (together, the “Services”).

This Policy explains what personal data we collect, why we collect it, the lawful basis on which we process it, whom we share it with, how long we keep it, and the rights available to you as a Data Principal under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”), read with the Information Technology Act, 2000 and other applicable law.

Where we ask for your consent, we will do so through a clear, standalone request accompanied by the itemised notice in Section 5. You are not required to agree to this Policy merely by browsing; consent to processing that requires consent is obtained separately and may be withdrawn at any time.

2.  Definitions

  • Personal Data: any data about an individual who is identifiable by or in relation to such data.
  • Data Principal: the individual to whom the personal data relates; where that individual is a child, it includes the parents or lawful guardian, and where a person with disability, it includes the lawful guardian.
  • Data Fiduciary: the person who, alone or with others, determines the purpose and means of processing personal data  here, Layers.
  • Data Processor: any person who processes personal data on behalf of Layers.
  • Processing: any wholly or partly automated operation performed on personal data, such as collection, recording, storage, use, sharing, disclosure or erasure.
  • Health & Fitness Data: personal data generated by the smartwatch and App relating to your body and activity, as described in Section 6.
  • Board: the Data Protection Board of India constituted under the DPDP Act.
  • Consent Manager: a person registered with the Board through whom a Data Principal may give, manage, review and withdraw consent.

3.  Scope of this Policy

This Policy covers personal data processed in connection with all Layers Services listed in Section 1, including both the Anarc and the Anarc 2 devices and their firmware, and the App on Android and iOS. Where a specific device, feature or region involves different processing, the applicable in-product notice or supplementary notice will govern that difference and prevails over any general statement here.

4.  Personal Data We Collect

Depending on how you use the Services, we may collect the following categories of personal data:

  • Contact & identity information — name, postal address, email address and telephone number.
  • Account information — login credentials for the App and website (passwords are stored in hashed form) and your preferences and settings.
  • Product & purchase information — device model and serial number, order history, warranty registration, returns and feedback.
  • Payment information — billing address and transaction records. Card and bank details are collected and processed directly by our PCI-DSS-compliant payment processors; Layers does not store full card numbers.
  • Device & technical data — device identifiers, hardware and firmware version, operating system, IP address, Bluetooth pairing data, app version, crash logs and diagnostic data.
  • Usage data — how you interact with the website and App, including pages/screens viewed, features used and time spent.
  • Customer-support data — the contents of your communications with us and related records.
  • Health & fitness data — as described in Section 6 below.

We collect personal data (a) directly from you, (b) automatically through the device, App, cookies and similar technologies, and (c) from third parties such as authorised resellers, marketplaces and payment or logistics providers, in each case only as needed for the purposes in Section 5.

5.  Purposes, Lawful Basis and Itemised Notice

Under the DPDP Act we may process your personal data only (i) with your consent, or (ii) for certain legitimate uses permitted by the Act. We do not rely on any open-ended “legitimate interests” balancing test. The table below is the itemised notice required by the DPDP Act and Rules: it sets out, for each purpose, the personal data used and the lawful basis relied on.


Purpose of Processing

Categories of Personal Data Used

Lawful Basis (DPDP Act, 2023)

Creating and managing your account; fulfilling and delivering orders; processing payments; providing customer support and warranty service

Contact information, product/purchase information, payment information (via payment processor), customer-support data

Consent; and the legitimate use of processing data you voluntarily provide for a specified purpose (s.7, DPDP Act)

Enabling core smartwatch functionality pairing the device, syncing the companion app, delivering firmware/OTA updates, and providing the health, fitness and activity features you switch on

Device and technical data (device identifiers, model, firmware, Bluetooth pairing data); health & fitness data (see Section 6); usage data

Consent (obtained at first app launch and per-feature toggle)

Diagnostics, crash analysis, security, fraud prevention and service improvement

Usage data, technical data, log data

Consent; legitimate use for security and prevention of fraud where applicable

Marketing, promotions and personalised offers

Contact information, usage data, cookie/advertising identifiers

Consent (opt-in; you may withdraw at any time)

Meeting legal, regulatory, tax and accounting obligations; establishing or defending legal claims

As required by the applicable obligation

Compliance with law / legitimate use (s.7, DPDP Act)


Your consent, where relied on, is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and is limited to the personal data necessary for the stated purpose. This notice is available in English and, on request or selection, in the languages specified in the Eighth Schedule to the Constitution of India. You may give and manage your consent directly or through a registered Consent Manager.

6.  Health, Fitness and Body-Related Data

The Anarc and Anarc 2 smartwatches and the App can, where you enable the relevant features, collect data about your body and activity. Depending on the features you turn on, this may include:

  • heart rate and resting heart-rate trends;
  • blood-oxygen (SpO₂) readings;
  • steps, distance, calories and activity/workout sessions;
  • sleep duration and sleep stages;
  • and, where offered and enabled, location/GPS data associated with an activity.

We treat this Health & Fitness Data as sensitive and process it only: (a) with your specific, feature-level consent; (b) to provide the health, fitness and activity features you have switched on; and (c) in de-identified or aggregated form for improving accuracy and performance. Each such feature can be turned off in the App, which stops further collection for that feature. We do not sell your Health & Fitness Data, and we do not use it for advertising.

7.  How We Share and Disclose Personal Data

We share personal data only as described below, and only with recipients bound to protect it and to use it solely for the purposes we specify:

  • Data Processors and service providers — payment processors, logistics and warehousing partners, cloud hosting and analytics providers, customer-support platforms and marketing agencies, each engaged under a written contract that meets the DPDP Act's requirements.
  • Technology and SDK providers embedded in the App/firmware — providers of software components used to deliver device connectivity, crash reporting, analytics and push notifications. The identities and locations of these providers, and the data each receives, are set out in Section 8 and Annexure A.
  • Legal and regulatory recipients — courts, regulators and government authorities where disclosure is required by law or to establish, exercise or defend legal claims.
  • Business transfers — an acquirer or successor in a merger, acquisition or sale of assets, subject to this Policy and applicable law; we will notify you of any resulting material change.

On request, we will provide the identities of all Data Fiduciaries and Data Processors with whom your personal data has been shared, together with a description of the data shared, as part of your right of access (Section 11).

8.  Cross-Border Transfer of Personal Data

Some of our Data Processors, SDK providers and group/design partners may be located outside India (our product is designed in the United Kingdom and certain components and technology partners are in other jurisdictions). Where personal data is transferred outside India, we do so in accordance with the DPDP Act, which permits transfer to any country other than those the Central Government may restrict, and subject to any sector-specific localisation requirements that apply to us.

A current list of the countries to which personal data is transferred, and the recipients, is maintained at Annexure A and updated as our processing changes.

9.  Security Safeguards

We implement reasonable technical and organisational safeguards appropriate to the risk, including:

  • encryption of personal data in transit and, where appropriate, at rest;
  • role-based access controls limiting access to authorised personnel;
  • pseudonymisation or de-identification of Health & Fitness Data where feasible;
  • logging, monitoring and periodic security testing and audits;
  • and contractual security obligations on our Data Processors.

No system is perfectly secure. You are responsible for keeping your account credentials and devices secure. If we detect a personal data breach, we will act in accordance with Section 10.

10.  Personal Data Breach Notification

In the event of a personal data breach, we will, in accordance with the DPDP Rules: (a) notify each affected Data Principal without undue delay, describing the nature and likely consequences of the breach and the measures we are taking and that you may take; and (b) notify the Data Protection Board of India without delay, and furnish a detailed report within 72 hours of becoming aware of the breach (or such longer period as the Board may allow on request). We maintain an internal breach-response plan and logs to support this obligation.

11.  Your Rights as a Data Principal

Subject to the DPDP Act, you have the following rights in respect of personal data processed on the basis of your consent or for certain legitimate uses:

  • Right to access information — to obtain a summary of the personal data we process about you, the processing activities, and the identities of all Data Fiduciaries and Data Processors with whom your data has been shared, along with a description of the data shared.
  • Right to correction and erasure — to have inaccurate or misleading data corrected, incomplete data completed, data updated, and personal data erased where it is no longer needed for the purpose or where you withdraw consent, unless retention is required by law.
  • Right of grievance redressal — to a readily available means of registering a grievance with our Grievance Officer (Section 14), who will respond within the period prescribed under the DPDP Rules.
  • Right to nominate — to nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity.

To exercise any of these rights, contact us using the details in Section 15 or through your App account. We may take reasonable steps to verify your identity. If you are not satisfied with our response, you may escalate to our Grievance Officer and thereafter to the Data Protection Board of India.

12.  Withdrawing Your Consent

You may withdraw your consent at any time  and doing so must be as easy as giving it. You can withdraw consent by turning off the relevant feature in the App, adjusting your account or notification settings, using a registered Consent Manager, or contacting us at the details in Section 15. Withdrawal does not affect the lawfulness of processing before withdrawal. Where you withdraw consent, we will stop the related processing and cause our Data Processors to do the same, unless we are required or permitted by law to retain the data. Withdrawing consent for data essential to a feature may mean that feature can no longer be provided.

13.  Children's Personal Data

The Services are intended for users aged 18 and above. We do not knowingly process the personal data of a child (a person under 18) except with verifiable consent of a parent or lawful guardian, obtained in the manner prescribed under the DPDP Rules. We do not undertake tracking, behavioural monitoring or targeted advertising directed at children, and we do not process children's data in a way likely to cause a detrimental effect on a child's well-being. If you believe we have collected a child's data without the required consent, contact our Grievance Officer and we will delete it promptly.

14.  Grievance Officer

In accordance with the DPDP Act and the Information Technology Act, 2000, the Grievance Officer for Layers is:

Name / Designation

Grievance Officer

Company

Layers Electronics Private Limited

Address

Office Space No. 1617, 16th Floor, Plot No. BW-58, Logix City Centre, Sector 32, Noida, Gautam Buddha Nagar, Uttar Pradesh 201301, India

Email

social@layers.shop

Phone

+91 98211 41699

Response time

within the period prescribed under the DPDP Rules


15.  Contact Us

Layers Electronics Private Limited

  • Address: Office Space No. 1617, 16th Floor, Plot No. BW-58, Logix City Centre, Sector 32, Noida, Gautam Buddha Nagar, Uttar Pradesh 201301, India
  • Email: support@layers.shop
  • Phone: +91 98211 41699

16.  Cookies and Similar Technologies

Our website uses cookies and similar technologies. Strictly-necessary cookies are used to operate the site. Performance, functional and advertising cookies are used only with your consent, collected through our cookie banner, and can be changed at any time through the banner or your browser settings. Advertising cookies are not deployed for users identified as children.

17.  Data Retention and Erasure

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by applicable law (for example, tax, accounting and warranty records). When the purpose is served or you withdraw consent and no legal basis for retention remains, we will erase or irreversibly de-identify the data, and cause our Data Processors to do the same.

18.  Changes to this Policy

We may update this Policy to reflect changes in our practices or the law. We will post the updated Policy with a new effective date and, where the change is significant or the law requires, notify you directly. Where a change requires fresh consent under the DPDP Act, we will obtain it before relying on the new processing.

19.  Governing Law and Jurisdiction

This Policy is governed by the laws of India. Subject to the DPDP Act (under which grievances are escalated to the Grievance Officer and then to the Data Protection Board of India), the courts at Delhi shall have jurisdiction.