Croma Privacy Policy 2026: Your Data and the Wider Tata Group

The defining feature of Croma's privacy notice is not what it collects but how far that collection reaches. The notice defines its sharing circle up front, and the circle is a conglomerate:

"Tata Sons Private Limited, and its subsidiaries, affiliates, associate companies and joint venture companies with whom we have a contractual arrangement" — the notice's own definition of Tata Group Entities. Croma is operated by IRL, "a company incorporated in India whose registered office is at Unit No. 701 & 702, Wing A, 7th Floor, Kaledonia, Sahar Road, Andheri (East), Mumbai 400069".

The sharing clauses then run outward. Croma "may make available to you products, services and/or applications of Tata Group Entities, to assist them to reach out to you in relation to their programs or campaigns", and accordingly "may share your Data with Tata Group Entities". Separately: "Your Data may be shared with Tata Group Entities and other participating entities on the Tata Consumer Platform operated by Tata Digital Limited" for enrolment and for offering products, services and benefits.

The practical reading is that an electronics purchase is an entry point to a group-wide customer record, not a transaction with one shop. The uses clause says so directly: data may be used to "enable Tata Group Entities and Partners to offer their products and/or services and communicate with you about such products and/or services".

Sharing data within a corporate group under contractual arrangements is lawful and extremely common, and no wrongdoing is alleged. The notice also attaches safeguards — it says appropriate written contracts are in place and that service providers must process data only on instruction. One caveat is the notice's own: "Tata Group Entities and Partners may have privacy practices that differ from those of IRL. The use of your Data will be governed by their privacy statements when you provide Data on their websites."

The categories of data listed under "Personal information" are broader than an electronics retailer's business obviously requires, and the notice lists them plainly:

"Age, sex, date of birth, marital status, nationality, details of government identification documents provided, occupation, ethnicity, religion, travel history or any other personal information provided in responses to surveys or questionnaires."

Two things should be said about that list immediately. First, the sentence ends by tying the category to information "provided in responses to surveys or questionnaires" — so the natural reading is a catalogue of what a customer might volunteer rather than a list of what is demanded at checkout. Second, this is a Tata Group notice template used across businesses, which plausibly explains categories like travel history and loyalty programme "frequent flyer or travel partner programme affiliation" appearing on an electronics site. Nothing here suggests Croma asks any customer for their religion or ethnicity to sell them a washing machine, and no such allegation is made.

The financial category is the one most directly tied to shopping: "payment instrument information, transactions, transaction history, preferences, method, mode and manner of payment, spending pattern or trends, and other similar data." Spending pattern or trends is an inference rather than a fact you hand over, and the notice addresses that too: "We treat these inferences as personal information (or sensitive personal information, as the case may be), where required under applicable law" — which is the right treatment and worth crediting.

The stated purposes include generating "aggregated data to prepare insights to enable us to understand customer behaviour, patterns and trends with a view to learning more about your preferences or other characteristics" and providing "offers (including for financial products and/or services), personalized services and recommendations".

The rights section is reasonably generous on paper. Depending on the applicable law you may "access your Data, rectify it, restrict or object to its processing, or request its deletion or anonymization", opt out of cookies and marketing, receive your data to transmit elsewhere, withdraw consent and lodge a complaint with a supervisory authority. Requests are free: "We will not charge you for any request", answered "within 30 days".

Two sentences qualify it. The first is about refusal: "Where we are legally permitted to do so, we may refuse your request. If we refuse your request, we will tell you the reasons why." Giving reasons for a refusal is good practice and not every notice commits to it.

The second is about what deletion actually achieves: "Even if we delete your Data, including on account of exercise of your right under Clause 12 below, it may persist on backup or archival media for audit, legal, tax or regulatory purposes."

That is an honest sentence and a technically accurate one. Backups are written to be immutable, and tax and audit rules require retailers to keep transaction records for years regardless of what a customer asks. Most privacy notices leave this implied; this one states it. The retention clause is equally candid: "Because these needs can vary for different data types and purposes, actual retention periods can vary significantly." There is no number anywhere in the notice.

Data location is specified and is in the customer's favour: "Data collected under this Privacy Notice is hosted on servers located in India."

The amendment clause does not promise notice before a change takes effect: "Our business changes constantly and our Privacy Notice will change also. We may e-mail periodic reminders of our notices and conditions, unless you have instructed us not to, but you should check our website and mobile application frequently to see recent changes. The updated version will be effective as soon as it is accessible. Any changes will be immediately posted on our website and mobile application and you are deemed to have accepted the terms of the updated Privacy Notice on your first use of our website or mobile application or first purchase of the products and/or services following the alterations."

Effective on posting, accepted on your next visit. The burden to check is placed on the reader, in the notice's own words — "you should check our website and mobile application frequently". This is why every quotation on this page carries the date it was read, 8 October 2026, and a reader checking later may find different text.

The business-transfer clause is brief: "As we continue to develop our business, we might sell or buy subsidiaries or business units. Your Data (including in relation to loyalty programs) may be transferred as part of such transaction." Unlike Amazon's equivalent clause, which carries forward "the promises made in any pre-existing Privacy Notice", this one attaches no such condition in its own words.

In-store collection is covered too, which is easy to miss on a chain with physical shops: data is collected "through our stores, website (including sub-domains and microsites) and mobile applications" and "when you conduct a transaction with us or attempt a transaction at our stores". An attempted transaction is enough.

It would be a poor reading of this document to present it as uniformly customer-unfriendly, because several provisions are better than the market norm and deserve saying so.

Servers in India. Inferences treated as personal or sensitive personal information where law requires. No charge for a data request, answered within 30 days, with reasons given for any refusal. An explicit statement that deletion does not clear backups, where most notices stay silent and let the customer assume otherwise. A named operating entity with a full registered address. And an unusually specific undertaking on third parties: service providers "will be required to only process Data in accordance with express instructions" and to implement "appropriate technical and organizational security measures and confidentiality obligations binding employees accessing Data."

The automatic-collection section is also specific rather than vague: web servers and analytics affiliates "collect IP addresses, operating system details, browsing details, device details and language settings", aggregated to measure visits, time on site and pages viewed.

The honest summary is that this is a well-drafted conglomerate privacy notice whose single most important feature is the size of the circle it shares with — and that the circle is disclosed clearly rather than buried, which is the thing a reader can actually act on.

Four practical points, none of them legal advice. One: understand that a Croma purchase can feed a group-wide record, since the notice provides for sharing with Tata Group entities and the Tata Consumer Platform — if cross-brand marketing is unwelcome, the marketing opt-outs are the lever, and the notice says you may "opt out of some collection or uses of your Data". Two: do not treat deletion as erasure — the notice says data may persist on backup and archival media for audit, legal, tax and regulatory purposes, which is normal and worth knowing in advance. Three: a data request is free and answered in 30 days, and a refusal must come with reasons, so it costs nothing to ask. Four: volunteer less in surveys — the broadest categories in the collection list are tied to survey and questionnaire responses, which is the part a customer controls entirely. Everything above is Croma's published notice as it stood on 8 October 2026 and it can change at any time. This page describes a published privacy notice and expresses no view on whether any part of it complies with any law; nothing here is legal advice.