Seller Privacy Policy

2. Information We Collect

We gather information necessary to assess brand eligibility, establish seller accounts, execute courier logistics, and disburse commercial payouts:

• Applicant & Identity Data: Full name, official business email, primary telephone number, job title/role, and government identification (PAN, Aadhaar/Passport as mandated for enterprise KYC).
• Brand & Corporate Details: Registered business name, trading label, Goods and Services Tax Identification Number (GSTIN), registered corporate address, manufacturing and warehouse locations for order pickup.
• Product Catalogue & Commercials: Brand product categories, SKU details, pricing ranges, ingredient/material compositions, high-resolution product photography, distribution volume, and brand social profiles.
• Financial & Banking Information: Bank account numbers, beneficiary names, IFSC codes, cancelled cheques, and tax registrations required to process delivered-order settlements.
• Application Drafts (Local Browser Storage): To provide a seamless application experience, form inputs are retained locally in your web browser's Web Storage (localStorage) so you can resume later. This data remains on your local device and is never transmitted to Woohl servers until you explicitly click “Submit application”.

3. Purpose of Processing

We collect and process your information strictly for the following purposes:

• Assessing your brand for catalogue curation, craftsmanship standards, and category alignment.
• Executing merchant onboarding, KYC verification, and contractual agreements.
• Operating the marketplace: processing customer orders, coordinating third-party logistics (3PL) pickups, handling exchanges/returns, and issuing electronic waybills.
• Calculating and remitting weekly/bi-weekly payouts, managing Tax Collected at Source (TCS) under the CGST Act, and filing required statutory returns.
• Communicating critical platform announcements, policy updates, logistics alerts, and customer dispute escalations.

4. Data Sharing & Third-Party Disclosures

Woohl maintains strict boundaries around seller data. We do not sell, rent, or lease merchant information. Data is shared strictly on a need-to-know basis with:

• Integrated Courier & Logistics Partners: Warehouse address, contact phone number, and package specifications are shared with verified logistics aggregators (e.g., Delhivery, Bluedart, Shiprocket) solely to facilitate pickups and shipments.
• Banking & Settlement Gateways: Settlement account numbers and IFSC codes are transmitted via secure API channels to RBI-licensed banking partners to effect automated commercial payouts.
• Statutory & Law Enforcement Authorities: When required by applicable Indian laws, court summons, GST audits, or statutory reporting guidelines.

5. Data Security & Encryption

We implement robust technical and managerial safeguards to protect your personal and commercial data:

• All network transmissions are encrypted using modern Transport Layer Security (TLS 1.3).
• Sensitive credentials and banking records are stored encrypted at rest using AES-256 standard encryption.
• Access to seller data is strictly gated by role-based access controls (RBAC) and audited regularly.
• Infrastructure is hosted within ISO 27001 and SOC-2 compliant data centers located within the Republic of India.

6. Data Retention & Deletion

We retain your information as long as you maintain an active seller relationship with Woohl. Upon account termination, we retain transaction and invoice records for a period of up to 8 years to fulfill our statutory obligations under Indian taxation and corporate laws.

If your application is not approved or if you decide to withdraw an application before going live, you may request deletion by emailing privacy@woohl.com. We will purge your personal contact records within 30 days, retaining only non-identifying curation logs.

7. Your Rights as a Merchant

Under applicable data protection laws, you have the right to:

• Review and request a copy of the personal data held about your brand.
• Request rectification of inaccurate, incomplete, or obsolete business information.
• Withdraw consent for optional communications or marketing features.
• Lodge a formal grievance regarding the handling of your data with our designated officer.

8. Grievance Redressal & Contact

Pursuant to Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the contact details of our Grievance Officer are provided below:

We acknowledge all received grievances within 48 hours and provide a complete resolution within 15 to 30 calendar days.