Privacy Policy

Welcome to Flexicartor, a global online marketplace operated by Flexicartor Private Limited, a company incorporated under the Companies Act, 2013, with Corporate Identification Number (CIN): U46901WB2025PTC281427.

Flexicartor operates as a marketplace platform that connects buyers and sellers worldwide. This Privacy Policy describes how we collect, use, store, share, and protect personal information when you access or use our website, mobile applications, and related services (collectively, the "Platform").

By accessing or using the Platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of the Platform immediately.

As a marketplace, Flexicartor facilitates transactions between independent buyers and sellers. Sellers on the Platform may have their own privacy practices for information they collect directly from you. We encourage you to review sellers' individual privacy policies when applicable.

We collect information from you in several ways when you interact with our Platform. The types of data we gather include:

Information You Provide Directly

• Account Registration: Full name, email address, phone number, date of birth, and account password when you create a Flexicartor account.
• Profile Information: Display name, profile photo, bio, preferences, and communication settings.
• Shipping & Billing Addresses: Complete postal addresses, city, state, country, and postal/ZIP code for order fulfillment and invoicing.
• Purchase Information: Details of items purchased, order history, wishlist items, and product reviews or ratings.
• Communication Data: Messages exchanged with sellers, customer support interactions, feedback, and survey responses.
• Identity Verification: Government-issued ID documents, PAN card, or other KYC documents when required for seller verification or high-value transactions.

Information Collected Automatically

• Device Information: Device type, operating system, browser type and version, unique device identifiers, and mobile network information.
• Usage Data: Pages visited, products viewed, search queries, click patterns, time spent on pages, and navigation paths.
• Location Data: IP-based approximate location, and precise location if you grant permission on your device.
• Log Data: Access timestamps, referring URLs, error logs, and server response codes.

Information from Third Parties

• Social Login Providers: When you sign in via Google, Facebook, or Apple, we receive your name, email, and profile picture as permitted by your privacy settings on those platforms.
• Payment Aggregators: Transaction confirmation, payment status, and limited payment instrument details (e.g., last four digits of card number).
• Logistics Partners: Delivery status, shipment tracking data, and delivery confirmation.
• Analytics Providers: Aggregated user behavior insights from third-party analytics services.

We process your personal information for the following purposes, based on our legitimate business interests, contractual obligations, your consent, and applicable legal requirements:

Purpose	Description
Order Fulfillment	Processing purchases, coordinating with sellers and logistics partners, managing shipping and delivery, and handling returns and refunds.
Account Management	Creating and maintaining your account, authenticating access, and managing your preferences.
Communication	Sending order confirmations, shipping updates, transactional emails, customer support responses, and important service notifications.
Personalization	Recommending products based on browsing history, customizing search results, and tailoring the marketplace experience to your preferences.
Marketing	Sending promotional offers, newsletters, and marketplace updates (with your consent where required by law).
Security & Fraud Prevention	Detecting and preventing fraudulent transactions, unauthorized access, and other illegal activities on the Platform.
Platform Improvement	Analyzing usage trends, conducting research, troubleshooting issues, and improving our services, features, and user experience.
Legal Compliance	Fulfilling obligations under applicable Indian and international laws, responding to legal processes, and enforcing our Terms of Service.

We do not sell your personal information. However, we share data with the following categories of third parties to operate the marketplace effectively:

Sellers on the Platform

When you place an order, we share your name, shipping address, phone number, and order details with the relevant seller to enable order fulfillment. Sellers are contractually required to use this data solely for completing the transaction and providing post-sale support.

Payment Aggregators (PAs)

We partner with RBI-licensed Payment Aggregators to process transactions. When you make a purchase, your payment information is transmitted directly to our PA partners. We share your name, email, phone number, and order amount with the PA to facilitate payment processing, fraud detection, and refund management.

Logistics & Shipping Partners

To facilitate delivery of products, we share your name, shipping address, phone number, and package details with our logistics partners. These include domestic couriers for India-based deliveries and international shipping providers for cross-border shipments.

Other Disclosures

• Service Providers: Cloud hosting providers, email service platforms, analytics tools, and customer support systems that assist in operating the Platform.
• Legal Obligations: When required by law, regulation, legal process, or governmental request.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your data may be transferred as part of the transaction.
• With Your Consent: We may share data for any additional purpose for which you provide explicit consent.

Critical Disclosure: Flexicartor does not directly process, store, or handle your full payment card details (credit card numbers, CVV, expiry dates). All payment processing is handled exclusively by our PCI-DSS compliant Payment Aggregator (PA) partners.

Our approach to payment security includes the following measures:

• PCI-DSS Compliance: All payment processing is performed by Payment Aggregators who are certified PCI-DSS (Payment Card Industry Data Security Standard) compliant. This certification is maintained by the PA, not by Flexicartor.
• Tokenization: Payment instruments are tokenized by the PA. Flexicartor only receives a token reference and limited information (e.g., last four digits, card network) for display and reconciliation purposes.
• Encryption: All data transmitted between your browser and our Platform, as well as between our servers and the PA, is encrypted using TLS 1.2 or higher.
• RBI Compliance: In accordance with Reserve Bank of India guidelines, we do not store your card-on-file data. Card tokenization and storage are managed by the PA and the respective card networks.
• Secure Redirects: During checkout, you may be redirected to the PA's secure payment page or your bank's 3D Secure authentication page. Flexicartor does not have access to the credentials you enter on these pages.

While we implement industry-standard security measures to protect your data on our Platform, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security and encourage you to use strong, unique passwords and enable two-factor authentication on your account.

We use cookies and similar tracking technologies to enhance your experience, analyze usage patterns, and deliver relevant content. The types of cookies we use include:

Cookie Type	Purpose	Duration
Essential	Required for basic Platform functionality, session management, authentication, and security.	Session / 30 days
Functional	Remember your preferences, language, currency, and recently viewed items.	Up to 1 year
Analytics	Help us understand how visitors interact with the Platform, page performance, and error tracking.	Up to 2 years
Marketing	Deliver personalized advertisements and measure the effectiveness of ad campaigns.	Up to 2 years

You can manage your cookie preferences through your browser settings or through the cookie consent banner displayed on the Platform. Disabling essential cookies may affect the functionality of the Platform.

We also use web beacons (pixel tags), local storage, and session storage for similar purposes. Third-party analytics tools such as Google Analytics may set their own cookies subject to their respective privacy policies.

As a global marketplace, your personal information may be transferred to, stored in, and processed in countries other than your country of residence. These transfers are necessary to operate the Platform and fulfill orders across borders.

For Users in the European Union (EU) / European Economic Area (EEA)

If you are located in the EU/EEA, we ensure that your personal data is transferred in compliance with the General Data Protection Regulation (GDPR). We rely on the following safeguards:

• Standard Contractual Clauses (SCCs): We use EU-approved Standard Contractual Clauses when transferring personal data to countries not recognized by the European Commission as providing an adequate level of data protection.
• Adequacy Decisions: Where applicable, we transfer data to countries that the European Commission has deemed to provide an adequate level of protection.
• Data Processing Agreements: We maintain Data Processing Agreements with all sub-processors that handle EU personal data, ensuring they adhere to GDPR standards.

For Users in India

Your data is primarily stored on servers located in India. When data is transferred outside India, we comply with the applicable provisions of the Digital Personal Data Protection Act, 2023 (DPDPA) and ensure adequate security measures are in place.

For Users in Other Jurisdictions

We comply with applicable local data protection laws in the jurisdictions where we operate. By using the Platform, you consent to the transfer of your information as described in this policy, subject to the protections outlined herein.

Depending on your location and applicable laws, you may have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal information we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data, subject to legal retention requirements.
• Right to Restrict Processing: Request that we limit how we use your data in certain circumstances.
• Right to Data Portability: Request your personal data in a structured, commonly used, machine-readable format.
• Right to Object: Object to the processing of your personal data for direct marketing or other purposes based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, withdraw your consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: File a complaint with a supervisory authority in your jurisdiction if you believe your data rights have been violated.

To exercise any of these rights, please contact us at privacy@flexicartor.com. We will respond to your request within 30 days or within the timeframe required by applicable law.

You can request account deletion from your account settings or by contacting our privacy team. Upon deletion, we will remove or anonymize your personal data, except where retention is required by law (e.g., for tax, legal, or dispute resolution purposes).

If you register as a seller on the Flexicartor marketplace, we collect additional information necessary for verification, compliance, and operational purposes:

KYC (Know Your Customer) Verification

• Business Details: Business name, registration number (GSTIN, MSME Udyam registration), registered address, and nature of business.
• Identity Documents: PAN card, Aadhaar card (with consent), passport, or other government-issued identification for identity verification of authorized representatives.
• Proof of Address: Utility bills, bank statements, or rental agreements to verify business address.
• Authorization Documents: Board resolutions, partnership deeds, or power of attorney as applicable to the business entity type.

Bank & Financial Details

• Bank Account Information: Account holder name, account number, IFSC code, and bank name for disbursement of seller payments.
• UPI Details: UPI ID if selected as a preferred payout method.
• Tax Information: GSTIN, PAN, TAN, and other tax identifiers required for TCS (Tax Collected at Source) compliance and invoice generation.

All seller KYC and financial information is encrypted at rest and in transit. Access is restricted to authorized personnel on a need-to-know basis, and all access is logged and audited regularly.

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law.

Data Category	Retention Period	Reason
Account Information	Duration of account + 3 years	Service provision and legal obligations
Transaction Records	8 years from transaction date	Tax, accounting, and legal compliance
Communication Logs	3 years	Dispute resolution and quality assurance
Seller KYC Documents	Duration of relationship + 5 years	Regulatory and anti-money laundering requirements
Usage & Analytics Data	2 years (then anonymized)	Platform improvement and analytics
Cookie Data	As specified in cookie table above	Functionality and analytics

When data is no longer required, it is securely deleted or anonymized so that it can no longer be associated with you.

The Flexicartor Platform is not intended for use by children under the age of 18 years. We do not knowingly collect personal information from children under 18.

If we become aware that we have inadvertently collected personal data from a child under 18, we will take immediate steps to delete such information from our records. If you are a parent or guardian and believe that your child has provided personal information on the Platform, please contact us at privacy@flexicartor.com so that we can take appropriate action.

Sellers on the Platform are prohibited from listing products that target children in a manner that would require the collection of children's personal data. Any violation of this policy by sellers may result in immediate suspension or termination of their seller account.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, and other factors. When we make material changes, we will:

• Post the revised policy on this page with an updated "Effective Date."
• Send a notification via email to the address associated with your account.
• Display a prominent notice on the Platform (e.g., a banner or pop-up notification).
• Where required by law, obtain your consent before applying material changes to previously collected data.

We encourage you to review this page periodically to stay informed about how we protect your data. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out to our privacy team:

• Company: Flexicartor Private Limited
• CIN: U46901WB2025PTC281427
• Email: privacy@flexicartor.com
• Postal Address: 214 Mayfair Elite, 8 Nolini Maitra Road, Kolkata - 700084, West Bengal, India

Grievance Officer: You may contact our designated Grievance Officer at the email above for any concerns regarding your personal data. We will acknowledge your complaint within 24 hours and resolve it within 30 days.

Governing Law: This Privacy Policy is governed by and construed in accordance with the laws of India. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the courts in Kolkata, West Bengal, India.