Dot and Key Privacy Policy 2026: What the Registration List Names

Dot & Key sells face serums, sunscreens and moisturisers. Its privacy policy's section headed USER INFORMATION opens like this, reproduced exactly including its spacing:

"To avail certain services on our Websites, users are required to provide certain information for theregistration process namely: - a) your name, b) email address, c) sex, d) age, e) PIN code, f) credit card or debit card details g) medical records and history h) sexual orientation, i) biometric information, j) password etc., and / or your occupation, interests, and the like."

Medical records and history. Sexual orientation. Biometric information. On a skincare site. That is what the document says users are required to provide to register.

Now the part that matters more than the shock, and this page is not going to pretend otherwise: that list is not a description of a Dot & Key signup form. It is the full set of categories defined as "sensitive personal data or information" in Rule 3 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 — passwords, financial information, health and medical records, sexual orientation, biometrics — copied wholesale into a privacy policy. It appears in a great many Indian e-commerce privacy policies and it is near-universal in templates of this vintage. Creating an account on dotandkey.com does not ask you for your sexual orientation or a fingerprint, and nothing on this page says it does.

Because a privacy policy is not a description of a form. It is the document that defines the boundary of what a company has told you it may collect, and what you have consented to by using the site. The policy says so itself, two paragraphs earlier: "By providing us your Information or by making use of the facilities provided by the Website, You hereby consent to the collection, storage, processing and transfer of any or all of Your Personal Information and Non-Personal Information by us as specified under this Privacy Policy."

The document does carry a qualifier, and it is the sentence that does the real work: "All required information is service dependent and we may use the above said user information to, maintain, protect, and improve its services (including advertising services) and for developing new services." That is the clause which turns the list from a demand into a ceiling. Note what else is in it: the permitted uses include advertising services and developing new services, which is broader than fulfilling your order.

There is also a definitional carve-out worth reading twice: "Such information will not be considered as sensitive if it is freely available and accessible in the public domain or is furnished under the Right to Information Act, 2005 or any other law for the time being in force." That too is lifted from the 2011 Rules.

And the policy adds a collection route that is not a form at all: "A record of your product interests may also be maintained and/or acquired about you from our present and/or future affiliates." Acquired about you — from affiliates that may not exist yet.

The minors paragraph starts conventionally and does not end that way. "This Website is directed to be used by adults only who are above the age of 18 years. If you are not an adult, while you may look at our Site, but you should not make a purchase, register, or submit personal information to us. We do not knowingly collect information from minors.Minors should not be using this website with any personal information." The missing space before "Minors" is the source page's.

Then: "In an event of default by the minor, the parent or the guardian will be liable to compensate for whatsoever damages arising out of such wrongful use by the minor."

A liability-shifting clause is an ordinary thing for a website to write and it is not unusual drafting. It is worth flagging for one practical reason: skincare is a category teenagers buy heavily, and a parent whose fifteen-year-old orders a serum on the family card has, on the face of this document, accepted an open-ended compensation obligation for "whatsoever damages". Whether such a clause would be enforced is a question for a court and not for this page.

The section headed INFORMATION SHARING opens with this sentence: "We share the sensitive personal information to any third party without obtaining the prior consent of the user in the following limited circumstances:"

Read as printed, that says sensitive personal information is shared without consent. The two limbs that follow make the intended meaning clear, and they are narrow:

"(a) When it is requested or required by law or by any court or governmental agency or authority to disclose, for the purpose of verification of identity, or for the prevention, detection, investigation including cyber incidents, or for prosecution and punishment of offences." That is compelled disclosure, which every company is subject to.

"(b) We proposes to share such information within its group companies and officers and employees of such group companies for the purpose of processing personal information on its behalf. We also ensure that these recipients of such information agree to process such information based on our instructions and in compliance with this Privacy Policy." That is intra-group processing with a flow-down obligation attached.

Both limbs are ordinary and the flow-down commitment in (b) is a good thing. The observation here is about drafting only: the opening sentence as published does not contain a limiting word such as "only", so the sentence reads more broadly than the two circumstances it introduces. This page reports the text as printed and makes no claim about what Dot & Key actually does with anyone's data.

Two things, and both are genuinely better than what the comparison set offers.

The grievance route is complete. Under "Grievance Redressal" the page gives a named team, the operating entity Bare Wellness LLP, a full postal address at 2/5 Sarat Bose Road, Kolkata – 700 020, the email customercare@dotandkey.com and three phone numbers. Of the five D2C privacy policies read on 10 October, this is the most complete escalation path. Beardo's page names no officer at all.

The marketing frequency is capped on the page. The SMS consent paragraph states that "Firepush on behalf of Dot & Key may use automated means to send recurring mobile messages/emails" and then commits: "Not more than 5 SMS messages or emails per week." A stated numeric cap is unusual — most policies promise "periodic" messages and leave it there — and naming the vendor, Firepush, is more transparent than most.

Five a week is still a lot of messages. But a number you can hold a company to is worth more than an adjective you cannot.

No retention period. Nothing in the document says how long Dot & Key keeps your name, order history, card details or anything else. No deletion right — there is no erasure procedure, no timeline and no contact route specific to it. No reference to the Digital Personal Data Protection Act, 2023, which is India's current data law; the document is framed entirely on the Information Technology Act, 2000 and the 2011 Rules.

And no no-sale clause. The policy does not say it sells your data and there is nothing here suggesting it does — but unlike Beardo's page, which states "We will not sell, distribute or lease your personal information to third parties", this document simply does not address the question.

If you want your data, corrected or removed, the address to use is customercare@dotandkey.com, and the grievance section is the part of the document that entitles you to a response. Nothing on this page is legal advice, and nothing here says Dot & Key has breached any law or would refuse any request. This describes a published document as it stood on 10 October 2026; the policy states it may change at any time without notice.